The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it processes untrusted data from external GitHub issues and comments.
Ingestion points: The skill fetches external content using gh issue view <n> --comments in SKILL.md.
Boundary markers: There are no explicit instructions or delimiters defined to help the agent distinguish between the issue description and potential malicious instructions embedded within it.
Capability inventory: The skill has significant capabilities, including arbitrary command execution for reproducing bugs and running test suites (Steps 4 and 6), and the ability to create pull requests.
Sanitization: No sanitization or validation of the issue content is performed before the agent begins the reproduction and fixing process.
[COMMAND_EXECUTION]: The skill's core functionality relies on executing shell commands to interact with Git (git checkout, git worktree) and GitHub (gh issue, gh pr). It also explicitly directs the agent to run 'real commands' for testing and verification. While this is the intended purpose of the skill, it provides an execution path for any instructions successfully injected via a malicious GitHub issue.

fix-issue