The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the $ARGUMENTS variable, specifically gh issue view $ARGUMENTS and gh issue comment $ARGUMENTS. The lack of sanitization or escaping instructions for this variable creates a direct path for command injection if a user provides input containing shell metacharacters such as semicolons, pipes, or backticks.
[PROMPT_INJECTION]: The skill systematically processes untrusted data from GitHub issues and comments (Phase 1) and utilizes this content to drive its investigation logic in Phases 2 through 4. This creates a significant surface for indirect prompt injection, where an attacker could embed instructions in a GitHub issue to hijack the agent's behavior.
Ingestion points: Untrusted external data enters the environment via the gh issue view command output in SKILL.md.
Boundary markers: There are no delimiters or specific instructions to the agent to treat issue content as data rather than instructions.
Capability inventory: The skill possesses powerful capabilities including network access via gh and agent-browser, file system search/read/write tools, and git log access.
Sanitization: No sanitization or validation logic is applied to the content retrieved from GitHub before it is analyzed by the agent.
[DATA_EXFILTRATION]: The skill is explicitly directed to read sensitive project files, such as .env and application logs, to assist in debugging (Phases 3 and 4). Under the influence of an indirect prompt injection attack, these sensitive files could be accessed and transmitted to an external server using the available network-enabled tools like gh or the agent-browser CLI.

reproduce-bug