The Agent Skills Directory

Indirect Prompt Injection: The skill is designed to ingest and analyze untrusted external data from GitHub, which presents an attack surface for indirect prompt injection.
Ingestion points: The workflow in SKILL.md requires the agent to read GitHub issue reports, pull request descriptions, comments, reproduction steps, and commit history.
Boundary markers: The instructions lack explicit structural delimiters (such as specific XML tags or unique string markers) to separate the untrusted external content from the agent's internal reasoning instructions.
Capability inventory: The agent evaluates code changes and drafts maintainer comments based on the ingested data. While the skill restricts tool usage (e.g., read-only access and limited gh command execution), the drafted output could still be influenced by malicious instructions hidden in issue comments.
Sanitization: The skill does not define specific sanitization or filtering logic for the content it retrieves from remote GitHub targets, relying instead on the agent's logical assessment to distinguish between proposed mechanisms and requirements.

maintainer-review