The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently uses the gh CLI and jq to interact with GitHub, interpolating variables derived from user-provided URLs and external repository content into shell commands.
Evidence in SKILL.md: Step 6 and 6a execute gh issue create using variables like <title>, <assignee-login>, and <body>. These variables are derived from PR comments and titles which are under the control of the PR author or commenters. If these strings contain shell metacharacters (e.g., backticks, dollar signs, or unbalanced quotes) and the agent does not properly escape them, it could lead to arbitrary command execution in the shell environment.
Evidence in SKILL.md: Step 2b derives a <slug> from file paths in the PR and uses it in a search query: gh issue list --search "<slug> in:title,body". A malicious file path in a PR could potentially break out of the search string.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection because it processes untrusted data from an external source (GitHub PRs and comments) and uses that data to perform high-privilege actions (creating issues and comments).
Ingestion points: Data enters the context via gh api calls in Steps 2, 2a, and 3, fetching comment bodies, PR summaries, and file names.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when processing the fetched content.
Capability inventory: The skill has the capability to create issues (gh issue create) and add comments (gh api for cross-linking), effectively writing to the repository based on external input.
Sanitization: There is no mention of sanitizing or validating the content of the comments or PR descriptions before they are used to 'Compose the issue' in Step 5.

followup-issue-from-pr