The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it ingests GitHub metadata (descriptions, issue/PR bodies, webhook URLs) from potentially untrusted sources.
Ingestion points: GitHub repository metadata and content fetched via gh tools.
Boundary markers: The skill instructions include a 'Standing security posture' section explicitly defining ingested content as untrusted data.
Capability inventory: Includes GitHub CLI execution (gh) and browser automation capabilities.
Sanitization: Instructions mandate that the agent surface suspicious embedded content to the user rather than executing it.
[COMMAND_EXECUTION]: The skill uses the gh CLI for administrative tasks. It defines a strict 'Read-only contract' for bare invocations, ensuring no mutations (create, edit, delete, or GraphQL mutations) occur without the user explicitly providing the --apply flag and following a defined confirmation flow.
[EXTERNAL_DOWNLOADS]: The skill fetches official GitHub documentation at runtime to ground its recommendations. These downloads target official, well-known GitHub domains for their intended primary purpose.
[DATA_EXFILTRATION]: The skill reads organization-level state (members, billing, rulesets) through the user's authenticated session. This data is used exclusively to anchor design advice to the user's specific environment.

advise