The Agent Skills Directory

[DATA_EXFILTRATION]: The skill hardcodes an absolute local file path: /Users/antonnovoselov/Documents/Vault/Projects/VivaDicta/what's new/whats-new-running.md. This exposes the author's local directory structure and directs the agent to modify files outside of the workspace context.
[INDIRECT_PROMPT_INJECTION]: The skill fetches untrusted data from GitHub PR reviews and comments and is instructed to "fix them immediately without asking" for critical bugs, creating a surface for autonomous execution of injected instructions.
Ingestion points: SKILL.md fetches external data using gh pr view and gh api repos/.../comments.
Boundary markers: No delimiters or instructions are provided to the agent to distinguish between legitimate feedback and potential prompt injections within comments.
Capability inventory: SKILL.md allows the agent to modify code, perform git operations, and write to local files.
Sanitization: There is no mechanism described to sanitize or validate the content of the comments before the agent acts upon them.
[COMMAND_EXECUTION]: The skill uses the GitHub CLI (gh) to interact with remote repositories. This tool access, combined with the instruction to autonomously fix bugs identified in external comments, enables a path for potentially malicious commands to be executed via manipulated PR feedback.

pr