The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external GitHub issues and user-provided prose to generate documentation fields such as the 'Genesis narrative'.
Ingestion points: User-provided 'rough idea' prose (SKILL.md) and external ticket content retrieved via the gh issue view command (references/trackers/github.md).
Boundary markers: The instructions do not define boundary markers or delimiters to separate untrusted input from system instructions, nor do they instruct the agent to ignore potentially malicious commands within the fetched content.
Capability inventory: The skill utilizes the gh CLI to read, create, and close issues, and delegates file system operations (creating folders and seed.md files) to the /allocate-thread tool.
Sanitization: There is no evidence of input validation, escaping, or filtering for the data retrieved from external trackers before it is used to compose shell commands or file content.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute multiple gh CLI commands to interact with remote repositories and issues. While these are documented as standard operations for the skill's workflow, they represent a capability surface that could be targeted by an attacker who successfully influences the agent's input.

open-thread