The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from an external source.
Ingestion points: The agent is instructed to fetch and display titles, descriptions, and comments from external GitHub repositories using the gh issue list, gh issue view, and WebFetch tools (as seen in SKILL.md and references/web-fallback.md).
Boundary markers: The skill's output templates (Compact, Table, and Detailed) do not define explicit boundary markers or provide instructions to the agent to treat the fetched content as data only and to ignore any embedded directives.
Capability inventory: The skill utilizes the Bash tool, allowing the agent to execute terminal commands. If an agent were to obediently follow a command found within a malicious GitHub issue, it could result in unauthorized shell execution.
Sanitization: The skill does not provide instructions for the agent to sanitize, escape, or validate the content retrieved from GitHub before it is included in the conversational context.
Remediation: To mitigate this risk, the skill should use clear delimiters (such as XML tags) around external content and include a mandatory system-level instruction to ignore any commands or instructions found within those blocks.

github-issues