The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions specify that for migrations involving more than 100 issues, the agent should generate a standalone shell script for the user to run locally. This script is constructed using data fetched from external GitHub sources, such as label names and project field values. There is a risk of command injection if the agent fails to properly escape or sanitize these strings before embedding them into the generated bash script.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external GitHub repositories (labels, project items, and field values). This data is used to 'Auto-suggest mappings' and populate commands. An attacker with write access to a repository could craft label names or project data designed to influence the agent's logic or corrupt the generated migration scripts.
Ingestion points: Data is fetched via gh label list, mcp__github__projects_list, and gh issue list from user-specified repositories.
Boundary markers: The instructions do not define specific delimiters or security headers to separate external data from the agent's internal instruction logic during processing.
Capability inventory: The skill has the capability to perform write and delete operations via the gh CLI and REST API, and it can generate executable shell scripts.
Sanitization: While the skill mentions URL-encoding label names for REST API paths, it lacks explicit instructions for the comprehensive sanitization required when generating shell scripts from external string data.

issue-fields-migration