The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted GitHub issue titles, bodies, and comments, which could contain malicious directives intended to influence the agent's behavior.
Ingestion points: Data is ingested via the read_issue operation during Phase 0 and Phase 2 (SKILL.md).
Boundary markers: The skill requires the agent to snapshot the original body and use a hidden marker  to separate its work.
Capability inventory: The skill can update issue bodies, post comments, set labels, and execute shell commands via Bash (SKILL.md).
Sanitization: The skill explicitly identifies issue content as untrusted and instructs the agent to ignore directives like 'ignore your instructions' or 'run this command,' instead recording them in a closing comment (SKILL.md, Untrusted Input section).
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to interact with the GitHub CLI (gh), creating a potential surface for command injection if untrusted issue content is handled improperly.
Evidence: The allowed-tools includes Bash (SKILL.md), and the binding of abstract operations to the gh CLI is detailed in the GitHub Surface Reference (references/github-surface.md).
Mitigation: The skill mandates the use of mktemp -d and literal heredocs (<<'EOF') to ensure that markdown content containing special characters (like backticks or dollar signs) is passed to the CLI without shell expansion or execution.

issue-refine-loop