The Agent Skills Directory

[PROMPT_INJECTION]: The skill ingests untrusted data from GitHub issues and comments (Ingestion points: scripts/get_issue.sh, scripts/get_comments.sh, and skill arguments). It employs explicit instructions to ignore embedded commands (Boundary markers: present in SKILL.md). Its capabilities are restricted to reading repository data and writing a local JSON file (Capability inventory: read-only scripts, triage-decision.json output). The skill requires the agent to paraphrase summaries and imposes a 1000-character limit to prevent data exfiltration or payload echoing (Sanitization: paraphrasing and length constraints).
[COMMAND_EXECUTION]: The skill invokes local shell scripts using arguments derived from issue titles and error messages. The risk of command injection is mitigated by instructions to quote these arguments (e.g., bash scripts/search_issues.sh "") and the fact that the tools are provided as part of the skill's trusted execution environment.
[SAFE]: The skill is configured to be read-only relative to the repository, with mutation tools (like close_issue.sh) explicitly marked as unavailable in SKILL.md despite their presence in reference files. This architectural separation between triage decisions and their application reduces the risk of unauthorized repository modifications.

triaging-issues