The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches content from external GitHub issues using gh issue view (referenced in Step 1 of SKILL.md). This data, which includes issue bodies and comments, is treated as the source of requirements for code implementation.
Ingestion points: Data enters the agent context through the output of the gh issue view command.
Boundary markers: The workflow lacks explicit delimiters or instructions to the agent to treat the fetched content as data rather than instructions, increasing the risk that the agent may follow malicious commands embedded within an issue description.
Capability inventory: The skill is granted powerful capabilities including Bash, Write, Edit, Read, Grep, and Glob tools.
Sanitization: There is no evidence of sanitization or filtering of the fetched issue content before it is processed by the agent.
[COMMAND_EXECUTION]: In Step 5, the skill is instructed to detect and run various build and verification tools via Bash (e.g., npm test, cargo test, pytest, gradlew build). While these are standard development practices, they involve executing code within the local repository environment. If the preceding implementation step was influenced by a malicious issue description, these verification commands could execute compromised code or tests.

github-do-issue