The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub pull request descriptions and comments, which could contain malicious instructions designed to influence the agent's behavior during the hardening process.
Ingestion points: In SKILL.md, the instructions fetch external content using gh pr view --json body and gh api --paginate "repos/{owner}/{repo}/issues/$PR/comments" to build implementation context and review findings.
Boundary markers: The skill lacks technical boundary markers or delimiters to isolate fetched GitHub content from its own instructions, though it conceptually advises the agent to "Verify each review comment against the code and requirements."
Capability inventory: The skill possesses extensive capabilities that could be targeted by an injection attack, including writing to the local filesystem, executing git commit and git push, and invoking external tools like codex and the /greploop skill.
Sanitization: There is no evidence of automated sanitization, filtering, or escaping of the content retrieved from the GitHub API before it is processed by the agent.

shipit