The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to dynamically determine and execute verification commands—such as tests, linters, and build processes—based on configuration files found within the target repository (e.g., .github/workflows/, package.json, or other project-level tool configs). If a repository contains malicious scripts or configurations, the agent may execute arbitrary code during the validation phase.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, including GitHub issues, pull request comments, and repository files (READMEs, code comments). This creates an attack surface where an attacker could embed malicious instructions in an issue or repository to manipulate the agent's logic or influence the code modifications it proposes.
Ingestion points: GitHub issues, PRs, comments, and repository source code/documentation (SKILL.md, Step 2).
Boundary markers: The instructions do not specify explicit delimiters or "ignore instructions" prompts when processing external content.
Capability inventory: The agent can perform file system modifications, Git operations (fork, push, PR), and execute shell commands for project builds/tests.
Sanitization: No specific sanitization or filtering logic is prescribed for the external text inputs.
[EXTERNAL_DOWNLOADS]: The skill frequently uses git clone and the GitHub CLI (gh) to fetch content from remote repositories. While GitHub is a well-known service, the repository content itself is untrusted and serves as the basis for subsequent command execution and file modification.

contributor