The Agent Skills Directory

[DATA_EXFILTRATION]: The skill explicitly directs the agent to include actual product data, including Protected Health Information (PHI), in screenshots for internal pull requests. This instruction encourages the bypass of standard data privacy best practices and results in the upload and storage of sensitive health data on third-party infrastructure (GitHub user attachments).
[INDIRECT_PROMPT_INJECTION]: The workflow ingests external data from existing pull request bodies, creating a surface where malicious content can influence the agent's behavior.
Ingestion points: The skill uses gh pr view to retrieve the current body of a pull request from the repository (SKILL.md).
Boundary markers: There are no instructions for using delimiters or explicit "ignore embedded instructions" warnings to help the agent distinguish between its own system instructions and untrusted content retrieved from the PR body.
Capability inventory: The agent has extensive capabilities to modify the repository environment, including the ability to edit pull requests, upload attachments, and overwrite PR descriptions via the gh CLI.
Sanitization: The instructions lack any requirement for validating, escaping, or sanitizing the content retrieved from the PR body before it is processed or written back to the repository environment.
[COMMAND_EXECUTION]: The skill utilizes shell commands to manage temporary files and interact with the GitHub CLI. While these are standard development tools, the lack of sanitization for the external pull request data being piped into these commands increases the risk of command injection or unintended system operations.

pr-screenshot-comparison