The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes several project-specific files, including AGENTS.md, CONTRIBUTING.md, and documentation files within the docs/ directory, to guide its ticket creation process. If these files are modified by an attacker (e.g., via a pull request), they could contain instructions that trick the agent into including malicious content or unexpected labels in the tracker tickets.\n
Ingestion points: SKILL.md reads AGENTS.md and documentation in docs/. references/repository-conventions.md reads CONTRIBUTING.md and .github/CONTRIBUTING.md.\n
Boundary markers: The skill does not provide the agent with explicit boundary markers or instructions to ignore potential commands embedded within these external files.\n
Capability inventory: The skill has the capability to create and close GitHub issues via the gh CLI, and read repository metadata via git.\n
Sanitization: No sanitization or validation is applied to the content extracted from these files before it is used in shell commands or ticket fields.\n- [COMMAND_EXECUTION]: The skill defines templates for shell commands using the gh and git CLI tools to interact with GitHub repositories. It interpolates data derived from repository files and user input directly into these command strings (e.g., gh issue create --title "<title>"). This creates a potential command injection surface if the agent or the platform does not properly escape special shell characters in the title or label fields.

open-ticket