The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it is designed to ingest and process untrusted data from external sources, specifically GitHub issues and pull requests. An attacker could craft a malicious report containing instructions meant to influence the agent's behavior during the triage process.
Ingestion points: The skill reads external content via gh issue list and gh pr list, as well as detailed issue descriptions in SKILL.md under the "Inputs" and "Workflow" sections.
Boundary markers: The instructions do not define explicit delimiters (like XML tags or triple quotes) or provide "ignore embedded instructions" warnings when interpolating retrieved issue content into the agent's context.
Capability inventory: The agent has the ability to execute shell commands (gh, bd), access local repository code for reproduction, and execute a local plugin script (safe-gh-comment.sh).
Sanitization: There are no instructions for the agent to sanitize, escape, or validate the content retrieved from the reporter before processing it.
[COMMAND_EXECUTION]: The skill uses a local shell script to handle outbound comments, which involves piping agent-generated text into an execution path: ${CLAUDE_PLUGIN_ROOT:-${HOME}/.claude-octopus/plugin}/scripts/safe-gh-comment.sh. While the script itself is part of the platform environment, the use of shell pipes for triaged data constitutes a capability that could be targeted if the content is not handled securely by the underlying script.

skill-intake