The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its design for processing external issue data.
Ingestion points: The skill reads untrusted content from GitHub issue titles, bodies, labels, and the entire comment thread (SKILL.md, Validate the request, Step 4).
Boundary markers: The skill looks for a specific mention trigger (@/glorp:<ID>), but it explicitly instructs the agent to treat these external comments as "direct instructions to this agent" that "must not be ignored," effectively allowing external users to influence agent behavior.
Capability inventory: The agent possesses significant capabilities, including filesystem modification, arbitrary test execution, network access via curl, and pull request merging through the gh and git CLIs.
Sanitization: No sanitization or escaping of the comment content is mentioned before it is treated as instructional input.
[COMMAND_EXECUTION]: The workflow relies heavily on executing shell commands via git, gh, and curl. This includes high-privilege operations such as accessing gh auth token and merging code into the default branch.
[DYNAMIC_EXECUTION]: The skill is instructed to run "focused tests" and "broader required checks" found within the target repository. This involves executing arbitrary code defined in the repository's own test suite and CI configuration (SKILL.md, Implement the fix, Step 6).
[EXTERNAL_DOWNLOADS]: The skill installs the github/gh-stack extension from GitHub's official repository to support stacked pull requests. It also mentions potentially installing Loom if visual capture tools are missing (SKILL.md, Capture UI screenshots, Step 4).

gh-fix