The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from untrusted external sources, including GitHub issues, Pull Request comments, and linked reproduction environments like CodeSandbox or StackBlitz. This creates a surface for indirect prompt injection attacks where an attacker could embed malicious instructions in an issue or PR to influence the agent's behavior.
Ingestion points: External data is ingested via gh issue view, gh pr view, and by following links to external code reproductions.
Boundary markers: The instructions do not specify the use of delimiters (e.g., XML tags or triple backticks) to separate the untrusted input from the agent's system instructions, nor do they include warnings for the agent to ignore instructions embedded in the data.
Capability inventory: The skill has significant capabilities, including executing shell commands (git, gh, yarn), writing/modifying code files, and creating new Pull Requests.
Sanitization: There is no mention of sanitizing or validating the content of the issues or PRs before the agent processes them as instructions.
[COMMAND_EXECUTION]: The skill performs shell operations using git, the gh CLI, and yarn (for building and linting). While these are standard for a development workflow, they are executed in a context where the parameters or the logic itself is derived from external, untrusted descriptions found in issues or plan files.

fix