The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external Gitee issues and comments, creating an attack surface for indirect prompt injection.
Ingestion points: The skill utilizes get_repo_issue_detail and list_comments (via the Gitee MCP server) to fetch external content including issue titles, descriptions, and discussion threads (SKILL.md).
Boundary markers: The instructions lack explicit delimiters or specific warnings to prevent the agent from following directives embedded within the fetched issue content.
Capability inventory: The agent has the capability to read and modify local source files, create pull requests (create_pull), and update issue metadata and comments (update_issue, create_comment) (SKILL.md).
Sanitization: No sanitization or validation mechanisms are described for the external content before it is processed by the agent to generate code or plans.
Mitigation: Implement strict delimiters around external content and explicitly instruct the agent to treat retrieved issue text as data rather than instructions. A human review step for the requirements analysis and generated code is recommended.

implement-issue