The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides numerous templates (e.g., ai-review.yml, issue-triage.yml, mention-bot.yml) that ingest untrusted external data such as pull request diffs, issue bodies, and commit messages. This data is interpolated directly into LLM prompts without explicit boundary markers or sanitization, creating an attack surface where an attacker could influence the agent's behavior (e.g., automated labeling, commenting, or risk assessment) via embedded instructions.
Ingestion points include issue.body in issue-triage.yml and git diff output in ai-review.yml.
Capability inventory: The workflows have permissions to write to issues and pull requests, and perform git operations like rebasing and force-pushing.
Boundary markers: The prompts use simple headers (e.g., 'Diff:', 'Body:') which are insufficient to prevent adversarial instruction overrides.
[COMMAND_EXECUTION]: Several examples, such as the 'Smart Cherry-Pick' implementation and the 'Auto Rebase' workflow, involve executing shell commands with variables derived from the GitHub environment (e.g., commit hashes, branch names). If these inputs are not strictly validated, they could potentially be exploited for command injection.
[EXTERNAL_DOWNLOADS]: The provided GitHub Action templates reference external dependencies including @anthropic-ai/sdk, actions/github-script, actions/checkout, and slackapi/slack-github-action. These resources are fetched from well-known and reputable service providers.

github-workflow-automation