The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from GitHub repositories, which constitutes a potential surface for indirect prompt injection attacks.
Ingestion points: The skill uses commands like gh pr view, gh issue list, and gh run view to read issue descriptions, PR bodies, and CI logs from remote repositories (SKILL.md).
Boundary markers: There are no explicit delimiters or instruction-ignore blocks around the ingested content to prevent the agent from interpreting data as instructions.
Capability inventory: The agent possesses capabilities to write to the repository, including merging pull requests and closing issues, which could be targeted by a successful injection.
Sanitization: No sanitization or validation of the external data is performed before it is added to the agent's context.
[EXTERNAL_DOWNLOADS]: The skill metadata provides instructions for installing the official GitHub CLI using well-known system package managers.
Evidence: The metadata section references installation via brew and apt, targeting the standard gh package.

github