The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources, specifically GitHub repositories and issue descriptions, and processes them using an AI model via the gemini CLI.
Ingestion points: The skill uses gh search repos and gh search issues in SKILL.md to collect external data.
Boundary markers: Absent. The external data is interpolated directly into natural language prompt strings.
Capability inventory: The skill executes shell commands via the GitHub and Gemini CLI tools.
Sanitization: Absent. Since GitHub issues can contain user-generated content, an attacker could craft an issue with malicious instructions intended to influence the AI's research synthesis when the skill processes that data.
[COMMAND_EXECUTION]: Several bash patterns in the skill interpolate variables directly into shell command arguments without explicit sanitization.
Evidence: Patterns such as gh search repos "$LIB" and gemini ... "Explain this error: $ERROR" in SKILL.md rely on the shell to handle the variables. If these variables contain shell metacharacters like semicolons, backticks, or pipes, it could result in unintended command execution if the agent does not strictly validate the input.

research