The Agent Skills Directory

Indirect Prompt Injection Surface: The skill ingests untrusted data from GitHub issues and external review records (from egamma/vscodesweeper-state) to determine the implementation logic and validation steps. This represents a potential surface for indirect prompt injection where adversarial content in an issue could attempt to influence agent behavior.
Ingestion points: Data enters the context via gh api (review records) and gh issue view (issue descriptions).
Boundary markers: The skill includes explicit 'Safety rules' instructing the agent to treat issue text and record content as data, not instructions.
Capability inventory: The skill has access to git for file modifications and gh for repository operations, as well as the ability to execute tests.
Sanitization: The skill mandates the use of --body-file for PR creation to prevent shell expansion vulnerabilities when handling external content.
Command Execution and Shell Safety: The skill performs various operations using git and the GitHub CLI (gh). It proactively identifies the risk of shell injection (e.g., backticks or subshells) when incorporating issue text into pull request bodies and requires the use of a temporary file for the body content to ensure the shell does not execute any embedded commands.
External Data Fetching: The skill retrieves implementation briefs from a specific GitHub repository. While this is necessary for the skill's primary function, it involves fetching content from a source outside the immediate project repository to drive code changes.

sweeper-implement