The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub issue titles, bodies, and comments via the gh issue view command. \n
Ingestion points: External data enters the context in SKILL.md during the 'Fetch issue' step.\n
Boundary markers: No delimiters or specific instructions are used to distinguish issue content from agent instructions, which could allow an attacker to hijack the agent's logic via a malicious issue description.\n
Capability inventory: The skill has extensive shell execution capabilities including git, gh, npm, and language-specific build tools defined in REFERENCE.md.\n
Sanitization: There is no evidence of sanitization or filtering of the fetched issue content before it is used to derive implementation tasks and acceptance criteria.\n- [DYNAMIC_EXECUTION]: In REFERENCE.md, the skill instructs the agent to read .github/workflows/ files and execute the discovered commands "verbatim". If a repository contains malicious workflow configurations, the agent will execute those commands on the user's machine without verification.\n- [COMMAND_EXECUTION]: The skill relies on executing various high-privilege development tools and scripts (e.g., npm test, pytest, cargo test). If used on a repository with malicious configuration files (like package.json scripts), this leads to arbitrary code execution on the local system.

fix-issue