The Agent Skills Directory

Indirect Prompt Injection Surface: The skill's primary function involves processing data from external sources like GitHub Alerts, Jira, and Linear, which may contain malicious instructions designed to influence agent behavior.
Ingestion points: Findings are imported from external sources described in references/github-rest-intake.md and references/ticket-intake.md, including GitHub Code Scanning, Dependabot, and Jira/Linear tickets.
Boundary markers: The skill contains explicit instructions in SKILL.md and references/github-rest-intake.md to ignore any embedded commands in the imported data and treat all fields as untrusted evidence data rather than instructions.
Capability inventory: The skill's capabilities are focused on read-only operations, including network GET requests to GitHub and Atlassian APIs, and reading local repository files. It is explicitly prohibited from editing files, running builds, or executing tests.
Sanitization: The instructions mandate separating observed facts from scanner prose and maintaining a strict read-only boundary during the triage process.
Credential Access Patterns: The skill defines a specific priority list for the agent to acquire GitHub authentication tokens from the environment or CLI tools to access private finding data. The instructions include a critical security rule: tokens must never be printed, logged, or included in any output, ensuring they remain in process memory for request headers only.
CLI Tool Integration: The skill uses local commands such as gh auth token and git credential fill to manage authentication. This is used solely for obtaining the necessary permissions to retrieve the security findings requested by the user.

triage-finding