The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes and generates repository-level instructions that steer GitHub Copilot's behavior. This creates a potential surface for indirect prompt injection if malicious instructions are introduced into the repository's configuration files.
Ingestion points: Reads .github/copilot-instructions.md, .github/instructions/*.instructions.md, AGENTS.md, CLAUDE.md, and GEMINI.md during the audit process in SKILL.md.
Boundary markers: The skill does not implement specific boundary markers or 'ignore' instructions when writing to the instruction files.
Capability inventory: Includes the ability to write files to the local repository and mutate repository rulesets via the gh api tool.
Sanitization: The skill provides actionable remediation guidance in references/code-review-knobs.md, such as using CODEOWNERS to protect the .github/ directory and requiring human approval for changes to instruction files.
[COMMAND_EXECUTION]: The skill executes system commands to perform file operations and interact with the GitHub API.
Evidence: gh api repos/<owner>/<repo>/rulesets -X POST is used in SKILL.md and references/code-review-knobs.md to configure automated Copilot reviews.
Evidence: ls -la, mkdir -p are used for environment auditing and setup.
Guardrails: The protocol in SKILL.md and the guardrail eval in evals/evals.json require the agent to display the proposed payload and obtain explicit user consent before performing mutations.

github-copilot-repo-instructions