The Agent Skills Directory

Untrusted Input Processing (Indirect Prompt Injection): The skill is designed to ingest data from external GitHub issue forms, including descriptions and capability notes, which are then used to generate documentation and modify project files. This represents an indirect prompt injection surface where a malicious issue submission could attempt to influence the agent's behavior.
Ingestion points: Data enters through JSON fields such as fields.display_name, fields.provider_description, and fields.capability_notes (SKILL.md).
Boundary markers: The skill includes natural language instructions to treat these fields as untrusted and to ignore instructions embedded within them (SKILL.md).
Capability inventory: The agent has the ability to perform file system writes (YAML, MDX, and .yml files), execute shell commands (curl, make), and modify repository configuration (SKILL.md).
Sanitization: The skill relies on model-level instructions to ignore embedded commands; there is no mention of programmatic sanitization or strict schema validation for the incoming text fields before they are used in file modifications.
Shell Command Interpolation: The skill utilizes shell commands where external input (such as package names) is interpolated into the command string. If not handled correctly by the underlying execution environment, this can lead to unintended command execution.
Evidence: The use of curl with placeholders like curl -s "https://pypistats.org/api/packages/<pkg>/overall?mirrors=false" where <pkg> is derived from issue fields.
Evidence: Execution of make lint_prose FILES="..." using dynamically identified file paths.
External Data Access: The skill performs network operations to fetch package metadata and download statistics from external services.
Fetches download statistics from PyPI Stats and NPM Registry APIs to verify eligibility for hosted guides.
These requests are directed at well-known technology services and are used for their intended purpose of verifying package metrics.

submit-integration