The Agent Skills Directory

[SAFE]: The skill employs secure shell command patterns, such as using single-quoted heredocs ('EOF') to prevent shell expansion of potentially untrusted body content. It also correctly restricts the agent's capabilities to a minimal set of necessary GitHub CLI subcommands in the frontmatter configuration.
[INDIRECT_PROMPT_INJECTION]: The skill reads external content from GitHub issues and pull requests, which could include untrusted comments from other users.
Ingestion points: The agent fetches the body and comments of a PR or issue using gh pr view or gh issue view within the Verify section of SKILL.md.
Boundary markers: The instructions do not specify any delimiters or ignore-instructions to isolate the fetched external data from the agent's verification logic.
Capability inventory: The skill allows the agent to execute GitHub operations such as creating, editing, and commenting on issues and PRs using the gh CLI as defined in allowed-tools.
Sanitization: Verification is performed by counting occurrences of the string user-attachments via grep -c. While a malicious user could potentially post a comment containing this string to trick the verification logic, the resulting impact is minimal (the agent might incorrectly assume an attachment was successful).

github-image-upload