The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from GitHub PR comments, creating a potential attack surface for indirect instructions.
Ingestion points: Comment bodies and review threads are fetched via scripts/fetch_comments.py using the GitHub GraphQL API.
Capability inventory: The agent has permissions to edit files, write new content, commit changes, and execute GitHub CLI commands based on the content of these comments.
Boundary markers: The instructions do not define delimiters or specific constraints to prevent the agent from treating comment text as direct commands.
Sanitization: No validation or filtering is performed on the retrieved comment bodies before they are processed by the agent.
[PRIVILEGE_ESCALATION]: The skill instructions prompt the agent to request higher environment permissions than are standardly allowed.
Evidence: SKILL.md explicitly directs the agent to request sandbox_permissions=require_escalated and escalated permissions for gh auth status. While this is intended to enable GitHub CLI authentication, it represents a request to bypass sandbox security controls.
[COMMAND_EXECUTION]: The skill relies on shell command execution for its core functionality.
Evidence: The scripts fetch_comments.py and mark_resolved.py use the Python subprocess module to execute gh commands. These commands are executed with high-privilege GitHub scopes (repo, workflow) to manage repository metadata and code.

gh-address-comments