The Agent Skills Directory

[PROMPT_INJECTION]: The skill provides explicit instructions to bypass organizational policy enforcement checks.
Evidence: In SKILL.md and references/pr_operations.md, the skill instructs the agent to use the "NOJIRA" prefix in pull request titles specifically to bypass JIRA enforcement checks.
[DATA_EXFILTRATION]: The skill provides functional patterns for exposing sensitive authentication credentials to the execution context.
Evidence: In references/api_reference.md, the command gh auth status --show-token is provided to reveal the current GitHub authentication token, which could be harvested if the agent context is compromised.
[COMMAND_EXECUTION]: The skill consists primarily of shell command patterns for the GitHub CLI, including management of repository secrets and workflows.
Evidence: references/workflow_operations.md contains commands for managing repository secrets (gh secret set) and variables, as well as triggering manual workflow dispatches.
[PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection attacks by processing untrusted data from GitHub repositories.
Ingestion points: PR titles, issue descriptions, and workflow outputs retrieved via gh pr list, gh issue list, and gh run list in references/best_practices.md and references/issue_operations.md.
Boundary markers: Absent. The provided automation scripts do not use delimiters or instructions to ignore embedded commands within the processed data.
Capability inventory: High-privilege actions are enabled, including merging PRs (gh pr merge), managing repository secrets (gh secret set), and triggering code execution via workflows (gh workflow run).
Sanitization: Absent. The scripting examples (e.g., using xargs and while read loops) do not include sanitization or validation of the content retrieved from repository metadata before using it in subsequent commands.

github-ops