The Agent Skills Directory

[DATA_EXFILTRATION]: The skill exports markdown content from local files and GitHub issues to https://www.proofeditor.ai. While this is the intended functionality for collaborative review, it involves sending potentially sensitive project data to an external third-party service.
[COMMAND_EXECUTION]: The skill utilizes several shell commands via the Bash tool to interact with the environment and GitHub:
gh issue view and gh issue edit for artifact synchronization.
curl for interacting with the Proof Web API.
uuidgen for generating idempotency keys.
mktemp and jq for file processing and synchronization.
[EXTERNAL_DOWNLOADS]: The skill fetches data from the Proof API (GET /api/agent/{slug}/v3/document) to ingest user comments and document revisions. This data is then used to influence agent decisions and modify local or remote content.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it processes untrusted input from an external collaborative surface:
Ingestion points: Comments and suggestions are retrieved from proofeditor.ai via API calls (SKILL.md, references/hitl-review.md).
Boundary markers: The instructions do not define specific delimiters for separating user feedback from the original document content during processing, although the agent is instructed to 'read the comment text' and 'decide how to respond'.
Capability inventory: The agent has the ability to write to the local filesystem (Write tool) and update GitHub issues (gh issue edit via Bash).
Sanitization: There is no evidence of programmatic sanitization or escaping for the content being synced back to the source; the agent relies on its own reasoning to evaluate the validity of comments before applying them.

proof