The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub history and pull requests, creating a potential surface for indirect prompt injection.
Ingestion points: The skill fetches data from GitHub PRs using gh pr view <number> --json title,body,comments,reviews in SKILL.md.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are defined for the fetched PR content.
Capability inventory: The skill has the capability to write and execute local scripts and tests in the user's environment as documented in SKILL.md.
Sanitization: There is no automated sanitization or filtering of the ingested content; the skill relies on a general instruction to "strip anything private before it goes anywhere public."
[DYNAMIC_EXECUTION]: The skill instructs the agent to dynamically create and execute scripts to verify code behavior at runtime.
Evidence: The instruction "Step 5: Write a script or test that runs the real code, run it, and paste what happened" in SKILL.md directs the agent to generate and run code.
Context: While this is a core feature for providing proof of safety, it involves the runtime execution of agent-generated code in the local environment.

blast-radius