The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from the repository environment.
Ingestion points: The skill reads VISION.md, README.md, and the output of gh issue list (which contains existing issue titles and bodies from the target repository).
Boundary markers: The instructions do not specify the use of delimiters or clear directives to the AI to ignore instructions potentially embedded within these external project files.
Capability inventory: The skill has the capability to write temporary files and execute shell commands, including creating GitHub issues via the gh CLI.
Sanitization: No sanitization or filtering is applied to the content fetched from the repository before it is used to draft the proposal.
Mitigation: The risk is significantly reduced by a mandatory preview and manual confirmation step (Step 6: Preview) where the user must explicitly approve the generated proposal before submission.
[COMMAND_EXECUTION]: The skill utilizes a local shell script (scripts/vapa-proposal.sh) to interface with the GitHub CLI.
The script uses variables like $repo and $subject derived from user input or AI inference directly in shell commands. Although variables are double-quoted (e.g., gh api "repos/$repo/issues"), there remains a minor risk of argument injection to the gh tool if the AI is manipulated into passing crafted strings containing CLI flags.

vapa-proposal