The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by design. It ingests data from external, potentially attacker-controlled sources.
Ingestion points: The skill fetches PR comments and reviews using gh pr view <pr-number> --json comments,reviews and gh api repos/{owner}/{repo}/pulls/<pr-number>/comments as described in Step 3 of the Flow.
Boundary markers: No boundary markers or 'ignore embedded instructions' warnings are present to distinguish between legitimate feedback and malicious instructions within the comments.
Capability inventory: The skill possesses significant write capabilities, including git commit, git push, and gh issue create, which could be abused if malicious instructions in a comment are executed.
Sanitization: There is no evidence of sanitization, validation, or filtering of the content retrieved from GitHub before the agent processes it to decide on code changes or issue creation.
[COMMAND_EXECUTION]: The skill uses git and gh (GitHub CLI) to perform repository and project management tasks. While these target well-known services (GitHub), the workflow involves executing these commands based on the interpretation of untrusted external content (PR comments), creating a path for automated actions that were not intended by the user.

oh-notes