The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script dynamically loads the flowing dependency at runtime from a hardcoded local path (/mnt/skills/user/flowing/scripts/flowing.py) using importlib and exec_module. While this is used to link sibling skills, dynamic code loading can be a vector for executing unexpected code if the source file is modified.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input that is then exfiltrated to an external platform (GitHub).
Ingestion points: The synthesis parameter in the close_issue function in scripts/closing_issues.py accepts arbitrary user-controlled text.
Boundary markers: Absent. The text is stripped of whitespace but not wrapped in delimiters or accompanied by instructions to ignore embedded commands.
Capability inventory: The skill has network write capabilities, specifically the ability to post comments and update issue states via the GitHub API (scripts/closing_issues.py).
Sanitization: Absent. The synthesis text is posted directly to GitHub as a comment without validation or escaping, which could allow an attacker to post malicious instructions or deceptive content to a public repository.

closing-issues