The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted report files which could contain malicious instructions designed to influence the agent's actions or result in stored payloads on GitHub.
Ingestion points: The skill reads report files from docs/evaluation/ and docs/security-audit/ directories in Phase 1 and 2.
Boundary markers: The instructions do not specify any boundary markers to isolate untrusted report content from the agent's control logic.
Capability inventory: The skill uses the GitHub CLI (gh) to list issues, create labels, and create issues with arbitrary titles and bodies.
Sanitization: Report content is interpolated directly into CLI commands and issue templates without explicit sanitization or escaping mechanisms.
Mitigation: The workflow includes mandatory user review steps in Phase 3 (task selection) and Phase 4 (duplicate confirmation), which act as significant security barriers.
[COMMAND_EXECUTION]: The skill uses shell-based CLI tools to interact with external services.
Evidence: Phase 4, 5, and 6 involve executing gh and jq commands for repository and issue management.
Context: These operations target GitHub, a well-known service, and are consistent with the skill's stated purpose.

report-to-issues