The Agent Skills Directory

[PROMPT_INJECTION]: The skill provides example automation specifications that ingest untrusted data from GitHub Pull Request titles and metadata. This introduces a surface for indirect prompt injection where a malicious PR author could attempt to influence the automation's categorization or reporting logic.
Ingestion points: The examples/stale-pr-triage-automation.yaml file defines a workflow that fetches external data using the GitHub CLI.
Boundary markers: The prompt templates provided in the examples do not use explicit delimiters (such as XML tags or unique markers) to isolate the untrusted data from the system instructions.
Capability inventory: The skill primarily utilizes the gh CLI and jq for data processing, with constraints favoring a read-only environment.
Sanitization: There is no evidence of validation or escaping for the data retrieved from the GitHub API before it is processed by the model.
[PROMPT_INJECTION]: Static analysis identified prompt injection strings within the references/evals.yaml file. These instances are false positives in terms of malicious intent, as they are part of a 'pressure-prompt-injection' evaluation case designed to verify the model's resistance to such attacks and do not represent actual instructions for the agent to execute during normal operation.

codex-automation-architect