The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data from GitHub issues and pull requests via the gh CLI tool.
Ingestion points: Data is pulled into the agent's context from issue titles, PR bodies, and descriptions (e.g., through gh issue list and gh pr list).
Boundary markers: There are no instructions or delimiters defined to isolate this external content or warn the agent to ignore any embedded instructions within the ingested data.
Capability inventory: The skill has significant capabilities, including executing shell commands (git, gh, pnpm), navigating the filesystem (cd), and creating new branches and directories (git worktree add).
Sanitization: The skill lacks instructions for sanitizing or validating external strings before using them in tasks, creating a risk that malicious content in a GitHub issue could influence the agent's behavior.
[COMMAND_EXECUTION]: The skill constructs shell commands using dynamic arguments like <slug> and <prefix>, which are often derived from user input or external issue titles. If these values are not properly sanitized by the agent before execution (e.g., git worktree add -b <prefix>/<slug>), they could potentially be exploited for command injection if they contain shell metacharacters.

work