The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data from GitHub issues, comments, and attachments which are potentially attacker-controlled.
Ingestion points: The skill fetches data in Phase 1 Step 3 using gh issue view and downloads external attachments in Phase 1 Step 4.
Boundary markers: Rule 10 explicitly instructs the agent to treat outside text as data and to ignore instructions contained within it.
Capability inventory: The skill uses bash, gh CLI, curl, maven, python, uv, and pnpm to perform its tasks.
Sanitization: Rule 10 requires the agent to wrap user-provided option values in single quotes to prevent shell injection, and Phase 1 Step 4 includes a script to verify that attachment URLs belong to trusted GitHub domains.
[COMMAND_EXECUTION]: The skill executes a wide range of shell commands, build tools (Maven, pnpm), and project scripts.
Evidence: The workflow involves running mvn, uv, and various repository scripts (e.g., scripts/build-java.sh, scripts/test-node.sh) that incorporate parameters sourced from GitHub issues.
Mitigation: The skill mandates human-in-the-loop approval for all GitHub writes and provides strict formatting rules (Rule 10) for shell commands to prevent command injection.
[EXTERNAL_DOWNLOADS]: The skill fetches dependencies and artifacts from remote sources.
Evidence: Downloads occur from github.com, pypi.org, npmjs.org, and specialized repositories like artifactory.openpreservation.org for tool dependencies. Attachment downloads are restricted to GitHub-owned domains in Phase 1 Step 4.

odl-fix