The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill aggregates data from several external sources that are not fully under the agent's control, such as GitHub issue titles, pull request descriptions, and local markdown plan files. This content is then presented in a structured dashboard used to determine the agent's 'next move'. If an attacker were to include malicious instructions in an issue title or plan file, the agent might interpret these instructions as legitimate commands when processing the dashboard.
Ingestion points: Project data is ingested from git log commands, GitHub metadata via gh issue list and gh pr list, and local files within the docs/plans/ directory.
Boundary markers: While the survey results are formatted into Markdown tables, there are no explicit instructions or delimiters telling the agent to treat the content of these tables as untrusted data or to ignore any embedded commands.
Capability inventory: The skill has permissions for Bash (shell execution), Read (filesystem access), Write (creating snapshots), Edit (modifying agent-guide files like CLAUDE.md), and Skill (invoking gitkit).
Sanitization: The skill uses --jq to extract specific metadata fields from GitHub to avoid ingesting full issue bodies, which reduces the attack surface but does not sanitize the contents of titles or plan files.

statuskit