The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by ingesting and processing untrusted content from external issue trackers.
Ingestion points: The skill fetches raw issue metadata, bodies, and comments using the GitHub CLI (gh issue view) and saves them as local artifacts (issue.json, comments/).
Boundary markers: The instructions require verbatim quoting of acceptance criteria and constraints in the issue-brief.md, which provides traceability but does not prevent the agent from potentially obeying instructions embedded within that data.
Capability inventory: The skill has capabilities to modify the local filesystem, perform Git operations, and execute shell commands.
Sanitization: The skill advises summarizing or redacting sensitive information in the source-map.md, but lacks specific mechanisms to sanitize inputs for malicious instructions.
[DATA_EXFILTRATION]: The skill performs network operations to fetch external data and assets.
Network operations: Downloads referenced images from URLs provided in issue bodies or comments into an images/ directory.
Context: While GitHub is a well-known service, the skill may follow links to arbitrary domains for image assets, which constitutes a low-risk network operation when not combined with sensitive file access.
[COMMAND_EXECUTION]: The skill uses local CLI tools to perform its tasks.
Evidence: The skill explicitly utilizes gh issue view to retrieve data and expects the agent to perform Git operations (branch, commit, merge, rebase) and potentially use browser tools for capturing UI evidence.
Safety: These are standard development tools and their usage is consistent with the skill's stated purpose.

vapa-exec