The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it fetches untrusted content from GitHub (issue bodies and PR comments) and interpolates it directly into sub-agent instructions without sanitization or boundary markers.
Ingestion points: GitHub REST API results from Phase 2 (Issues) and Phase 6.2 (Review comments) in SKILL.md.
Boundary markers: None. Untrusted variables such as {body}, {title}, and {json_array_of_actionable_comments} are used directly within the sub-agent task templates.
Capability inventory: Sub-agents have access to git, curl for network requests, and the ability to execute shell commands and node scripts.
Sanitization: No escaping or validation of external content is performed before interpolation.
[REMOTE_CODE_EXECUTION]: Sub-agents are explicitly instructed to discover and execute local test suites (e.g., npm test, pytest, cargo test, Makefile) within the repository being fixed. This involves executing code from potentially untrusted external repositories.
[COMMAND_EXECUTION]: The skill and its sub-agents use node -e to execute inline JavaScript for the purpose of parsing JSON configuration files (e.g., /data/.clawdbot/openclaw.json) to retrieve the GH_TOKEN. This pattern exposes authentication tokens to sub-agents that are simultaneously processing untrusted input.

gh-issues