The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because it is explicitly instructed to treat GitHub issue comments mentioning a specific ID as direct, high-priority instructions that 'must not be ignored'. An attacker with the ability to comment on a repository's issues could potentially override the skill's logic or execute unauthorized commands.
Ingestion points: SKILL.md specifies reading the issue title, body, and all comments chronologically to gather context and instructions.
Boundary markers: No boundary markers or 'ignore embedded instructions' warnings are present to separate the user's instructions from untrusted data in the issue thread.
Capability inventory: The skill has access to the gh CLI (repository/PR management), git (filesystem operations), curl (network requests), and the ability to install new software.
Sanitization: No sanitization or filtering of issue comment content is described before the agent processes it as instructions.
[CREDENTIALS_UNSAFE]: The skill instructs the agent to use $(gh auth token) within a curl command to upload assets to an undocumented GitHub endpoint. While the endpoint belongs to GitHub, an injection attack that overrides the curl URL could lead to the exfiltration of the user's GitHub authentication token to an attacker-controlled server.
[EXTERNAL_DOWNLOADS]: The skill includes instructions to dynamically install 'Loom' if a suitable capture tool is not available on the host system. Runtime installation of external software introduces supply chain risks, although Loom is a well-known service.
[COMMAND_EXECUTION]: The skill operates with high autonomy, executing a variety of shell commands (git, gh, curl, and software installers) across multiple directories. This autonomy increases the potential impact if the agent is compromised via prompt injection.

gh-fix