The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches content from external, untrusted sources (GitHub Pull Request titles, bodies, and comments) and stores them in a structured knowledge base without sanitization. If a GitHub contribution contains malicious instructions or jailbreak attempts, they will be persisted in the engineer's profile and may influence an AI agent that later uses the profile as context.
Ingestion points: The script scripts/extract_engineer.sh fetches pull request details, including titles and bodies, using the gh pr view command.
Boundary markers: The skill does not use boundary markers or delimiters when writing external content to the markdown files in the engineer_profiles/ directory.
Capability inventory: The skill has the capability to execute shell commands (via the GitHub CLI) and write to the local file system.
Sanitization: The script performs no sanitization or filtering of the text content extracted from GitHub contributions.
[COMMAND_EXECUTION]: The interactive script scripts/extract_engineer.sh contains a command injection vulnerability in the prompt_input helper function.
Evidence: The function uses eval "$var_name=\"$input\"" to assign user-provided input to variables. This allows a user to execute arbitrary shell commands by providing input containing command substitution patterns (e.g., $(command) or `command`).
Impact: While this requires local interactive input, it represents a security flaw in how the skill handles its own configuration and execution flow.

engineer-expertise-extractor