The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub issues and pull requests.
Ingestion points: Untrusted data enters the agent context through ${{ steps.changed.outputs.files }}, ${{ steps.diff.outputs.diff }}, issue.title, issue.body, and @mention bot comments in SKILL.md.
Boundary markers: The templates provide some basic markdown formatting, but lack explicit instructions to the AI to ignore embedded commands within the diffs or issue text.
Capability inventory: The GitHub Actions configured have pull-requests: write and issues: write permissions, and use actions/github-script to execute JavaScript logic.
Sanitization: There is minimal sanitization shown for the inputs (e.g., sed for the mention bot), which could allow an attacker to inject instructions into a PR or issue that the AI assistant then follows (e.g., mislabeling, posting malicious comments).
[COMMAND_EXECUTION]: The skill uses git and gh CLI tools within GitHub Actions workflows to perform repository operations.
Evidence: Execution of git diff, git rebase, git push --force-with-lease, and gh pr checkout in SKILL.md sections 1.1, 3.1, 4.1, and 5.1. These are standard for CI/CD but represent a capability surface for prompt-driven attacks if the AI is influenced by malicious PR content.

github-workflow-automation