The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is instructed to read GitHub issue bodies, all associated comments, and external content fetched via WebFetch. Attackers can place malicious instructions in these locations to manipulate the agent's behavior.
Ingestion points: Data enters the agent's context through gh issue view (body and comments) in SKILL.md and via the WebFetch tool when processing external links.
Boundary markers: None are present. There are no instructions or delimiters used to warn the agent to ignore or isolate instructions found within the processed data.
Capability inventory: The agent has extensive capabilities including shell execution (Bash), file modification (Edit, Write), and repository management (git push, gh pr create).
Sanitization: There is no evidence of sanitization or filtering of the ingested content before it is processed by the model.
[COMMAND_EXECUTION]: The skill uses the $ARGUMENTS variable to construct shell commands, specifically gh issue view <ref>. If the agent does not strictly validate the input during the "parse" step, it could lead to command injection where malicious characters are executed in the shell environment.
[EXTERNAL_DOWNLOADS]: The skill uses WebFetch to retrieve content from external URLs found in issue comments. While intended for reading release notes, this facilitates the ingestion of arbitrary remote data into the agent's context.

fix-issue