The Agent Skills Directory

[COMMAND_EXECUTION]: The github::exec function enables the agent to run arbitrary arguments through the gh binary. This provides a broad range of capabilities including repository management, secret manipulation, and account configuration, which could be misused if the agent is misled by malicious input.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes data from external, potentially untrusted sources.
Ingestion points: Untrusted data enters the agent's context through github::pr::view, github::issue::view, github::search::code, and various comment/description fields in SKILL.md.
Boundary markers: The skill instructions do not specify any delimiters or safety markers to separate retrieved GitHub content from the agent's core instructions.
Capability inventory: The skill has high-privilege capabilities such as merging PRs (github::pr::merge), triggering Actions (github::workflow::run), and the unrestricted github::exec escape hatch.
Sanitization: There is no evidence of sanitization, filtering, or validation of the content retrieved from GitHub before it is presented to the agent.

github