The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub issue descriptions and comments, which could contain malicious instructions designed to hijack the agent's behavior.
Ingestion points: Fetches external data using gh issue view and GitHub API requests to api.github.com.
Boundary markers: The skill does not implement boundary markers or instructions to isolate untrusted content, allowing the LLM to potentially interpret issue text as commands.
Capability inventory: The workflow allows execution of shell commands (git, gh, pip, npm, cargo, go), file system writes, and remote repository updates (git push).
Sanitization: There is no evidence of sanitization or filtering applied to the fetched issue content before it is used in brainstorming and development steps.
[COMMAND_EXECUTION]: The skill utilizes multiple shell commands to synchronize code, manage dependencies, and interact with version control systems.
Evidence: Execution of git, gh CLI, and language-specific build tools like pip, npm, cargo, and go.
[PROMPT_INJECTION]: The skill documentation defines an 'Automation Mode' (triggered by the phrase '自动化处理') that explicitly instructs the agent to proceed without user confirmation. This bypasses typical human-in-the-loop safety checks, amplifying the risk when handling untrusted external data.

github-issue-autofix-workflow