The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from GitHub issue titles, bodies, and comments.
Ingestion points: The skill uses gh issue view to fetch external content from GitHub into the agent's context.
Boundary markers: No specific delimiters or instructions are provided to the agent to treat issue content as data rather than instructions.
Capability inventory: The skill is restricted to read-only operations using gh, git, and file system search tools.
Sanitization: No sanitization or filtering is performed on the ingested issue content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill executes standard shell commands (gh and git) to retrieve repository information. These commands are used in a read-only capacity as described in the procedure.

root-cause