The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by reading public GitHub issues, pull request descriptions, and repository-level instruction files like CONTRIBUTING.md.
Ingestion points: Data is pulled from the GitHub API using gh issue view, gh pr list, and gh api for content retrieval, as well as local file inspection via Read, Glob, and Grep if a state directory is provided (e.g., in SKILL.md Step 2).
Boundary markers: The skill contains explicit instructions to treat repository-scoped guidance as non-authoritative over the host or user, acting as a behavioral constraint for the agent.
Capability inventory: The skill has access to Bash for gh, git, and jq commands, along with file system read access (Read, Glob, Grep). While instructed to be read-only, these tools provide the capability to interact with the system if the model is influenced by injected instructions.
Sanitization: No technical sanitization, escaping, or schema validation of the retrieved GitHub content is described before it is presented to the model context.

contribute