The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from the user and interpolating it into executable shell commands and project documentation.
Ingestion points: User-provided responses to the five setup questions in SKILL.md (e.g., GitHub usernames, rights levels, merge rules).
Boundary markers: The skill uses [BRACKET] placeholders in templates (TEAM-GUIDE.md, AGENTS.md) for interpolation, but lacks clear delimiters or warnings for the agent to ignore instructions embedded in user-supplied strings.
Capability inventory: The skill has high-privilege capabilities including repository modification via gh api (writing settings, adding collaborators), file system write access (AGENTS.md, TEAM-GUIDE.md, scripts/hooks/pre-push), and network operations via git push and GitHub API calls.
Sanitization: There is no evidence of input validation or escaping for the <username> variable before it is passed to the shell via gh api -X PUT "repos/$OWNER/$REPO/collaborators/<username>". A malicious user could attempt command injection through these fields.
[COMMAND_EXECUTION]: The skill makes extensive use of the GitHub CLI (gh) and Git to perform administrative tasks. While these are necessary for the skill's stated purpose of setting up a team environment, they represent a significant attack surface if the agent is manipulated.
Evidence: gh repo edit, gh api -X PUT .../collaborators/, gh workflow enable, and git push are used to modify the state of the repository and its security settings.

website-team-setup