The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external issue trackers (GitHub, Jira, Linear) and instructs the agent to "follow reported reproduction steps" and "extract reported symptoms... from the combined thread." An attacker who controls an issue or comment could embed malicious instructions that the agent might execute while attempting to reproduce a bug.
Ingestion points: The skill reads issue references from the #$ARGUMENTS variable and fetches content using the gh tool or direct URL fetching.
Boundary markers: The input is wrapped in <bug_description> tags, which provide a basic delimiter but do not prevent the agent from obeying instructions found within the fetched content.
Capability inventory: The agent has a high level of capability, including shell access (executing tests and CLI tools like gh and npm), file system access (writing tests and code fixes), and web browsing.
Sanitization: No explicit sanitization or validation of the external content's instructions is mentioned before the agent is told to follow the reproduction steps.
[COMMAND_EXECUTION]: The skill instructs the agent to run various shell commands for environment verification (git, npm install, bun install, bundle install) and bug reproduction. While these are necessary for the skill's primary purpose, the agent is directed to derive and execute commands based on untrusted external issue descriptions, which presents a risk of executing malicious payloads if an injection occurs.
[EXTERNAL_DOWNLOADS]: The skill fetches data from well-known services such as GitHub, Jira, and Linear. These downloads are performed using legitimate developer tools (e.g., gh issue view) and are integral to the skill's function of debugging reported issues.

ce-debug