The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection. \n
Ingestion points: The agent ingests data from external sources including GitHub issue bodies and comments (SKILL.md, references/comment-chain-storage.md) and CI failure logs (Step 9 in SKILL.md via gh run view <run-id> --log-failed). \n
Boundary markers: No explicit boundary markers or 'ignore embedded instructions' warnings are provided when processing external content retrieved from GitHub. \n
Capability inventory: The skill possesses high-privilege capabilities including modifying source code, committing and pushing to repositories (git push, commit-push-pr), and modifying project metadata on GitHub (gh pr edit, gh issue comment). \n
Sanitization: There is no evidence of sanitization or validation of the external content before it is used to influence the agent's autonomous decisions or code edits in the fix-and-push loop (Step 9). \n
Autonomy: The 'anti-stall' instruction explicitly directs the agent to run without user intervention, which amplifies the risk that an injected instruction could be executed without oversight. \n- [PRIVILEGE_ESCALATION]: The skill explicitly uses powershell.exe -ExecutionPolicy Bypass to execute its gating scripts (Step 1, 2, 2a, 10 in SKILL.md). While common in automation, this bypasses local security policies designed to restrict unauthorized script execution. \n- [COMMAND_EXECUTION]: The skill executes local bash and PowerShell scripts (scripts/gate.sh and scripts/gate.ps1) to verify stage transitions. These scripts process external inputs like issue numbers and contract file paths. If the agent does not properly validate these inputs, it could lead to command injection, although the orchestration logic generally treats these as internal handles.

lfg