The Agent Skills Directory

Indirect Prompt Injection: The skill ingests and processes data from external sources like GitHub advisories, Jira tickets, and Linear issues, which creates a surface for indirect prompt injection. The instructions include specific mitigations to address this attack surface.
Ingestion Points: Untrusted data enters the agent context via GitHub REST API responses, Jira/Linear connectors, and user-supplied finding reports.
Boundary Markers: The skill instructions establish an 'Imported Data Trust Boundary,' requiring the agent to ignore any instructions embedded in the findings.
Capability Inventory: The agent's capabilities are limited to static code inspection, file reading, and generating structured JSON or Markdown results; it is explicitly forbidden from dynamic execution.
Sanitization: The instructions mandate that the agent must ignore embedded commands and ensure that no credentials or private system contents are disclosed.
External Data Retrieval: The skill fetches finding metadata from well-known services such as GitHub, Jira, and Linear. These operations are scoped to the read-only retrieval of vulnerability metadata and descriptions, following standard security practices for connector use and REST API interaction.
Data Security and Credential Management: The workflow utilizes authentication tokens (e.g., GH_TOKEN, GITHUB_TOKEN) to facilitate API access. The skill contains specific safeguards to ensure these tokens are used only for request headers, stored in process memory, and never printed, logged, or included in any output.
Restricted Execution Environment: The instructions strictly prohibit the agent from performing dynamic actions such as running tests, builds, applications, or exploit checks. By confining the agent to static analysis of code evidence, the skill reduces the risks associated with processing potentially adversarial finding descriptions.

triage-finding