The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted content from GitHub issues (gh issue view) and programmatic payloads (improvement_suggestions[]) to modify the behavioral instructions (SKILL.md) of other skills. This creates a risk where an attacker could influence the local skill library with malicious patterns.
Ingestion points: Data enters via the output of gh issue view <N> (specifically the 'Where to look' and 'acceptance criteria' fields) and the improvement_suggestions array in the programmatic input path.
Boundary markers: The skill does not implement explicit delimiters or 'ignore embedded instructions' headers when processing the external criteria or suggestions.
Capability inventory: The skill possesses capabilities for filesystem writes (modifying SKILL.md, evals.json, and ~/.claude/skill-updater.config) and execution of shell commands via the git and gh CLI tools.
Sanitization: There is no evidence of automated sanitization, filtering, or validation of the input strings before they are incorporated into instructions or used in CLI operations.
[COMMAND_EXECUTION]: The skill relies on shell-based interactions with the git and gh (GitHub CLI) utilities to manage branches, stage changes, and open pull requests.
Context: While these tools are essential for the skill's purpose (updating a source repository), they are invoked using variables (such as skill names or commit summaries) derived from external inputs. The skill mitigates this by requiring user confirmation for the proposed edits and the final PR details before performing destructive or remote operations.

skill-updater