The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill is designed to ingest and process GitHub Quick Review (ghqr) scan data, which represents an indirect prompt injection surface. Because the skill incorporates external data into its report generation process without explicit sanitization or boundary markers, it could potentially process malicious instructions embedded within the scan data (such as in repository names or issue descriptions).
Ingestion points: The skill acquires data through the ghqr_scan tool output or user-provided JSON files as described in Phase 1 of the workflow.
Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the report template when interpolating scan findings.
Capability inventory: The agent utilizes the ghqr_scan tool and standard file operations to read scan data and write the resulting Markdown report.
Sanitization: The skill lacks explicit instructions for the agent to sanitize, escape, or validate the content of the scan data before including it in the final report.

ghqr-report