The Agent Skills Directory

[PROMPT_INJECTION]: The skill is highly susceptible to Indirect Prompt Injection due to its core workflow of ingesting and following instructions from external GitHub issues.
Ingestion points: In SKILL.md, the agent is instructed to fetch the "issue packet" and linked PRDs using gh issue view <number> --comments and gh issue view <number> --comments for linked context. These sources are controlled by external users (issue authors and commenters).
Boundary markers: Absent. The instructions explicitly state to "Treat the issue packet, linked PRD/spec, existing tests, and repo instructions as the source of truth" without any warnings or delimiters to differentiate between legitimate bug reports and malicious instructions embedded in the issue text.
Capability inventory: The skill possesses significant capabilities, including filesystem write access (to "Fix every valid finding"), network access via the gh tool, and arbitrary code execution through the Verify step using uv run and pytest (as described in SKILL.md).
Sanitization: Absent. The skill does not implement any validation, escaping, or filtering of the fetched GitHub content before interpolating it into the agent's reasoning process.
[COMMAND_EXECUTION]: The skill routinely executes shell commands to perform its tasks.
Evidence: SKILL.md contains instructions to execute gh issue view, git status, git log, git diff, git commit, and uv run python -m compileall. While these are standard tools, their use on a codebase that has been modified based on untrusted GitHub input increases the risk of the agent being tricked into executing malicious commands during the verification or testing process.

review-issue