The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the GitHub CLI (gh) and git to interact with the local repository and the GitHub API.
Evidence includes data gathering commands (gh repo view, gh issue list, gh pr list, gh api collaborators) and action commands (gh issue comment, gh issue edit, gh issue close) defined in Phase 1 and Phase 3 of SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub issues which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Data is fetched from GitHub issue titles, bodies, and comments using gh issue list (SKILL.md, Phase 1 & Phase 2).
Boundary markers: The subagent prompt in Phase 2 uses markdown formatting (e.g., **Body**: {body}) to separate fields, but lacks explicit instructions for the AI to ignore instructions embedded within the processed issue content.
Capability inventory: The skill possesses write-access capabilities to the GitHub repository, including the ability to post comments, modify labels, and close issues via the gh tool.
Sanitization: There is no evidence of input sanitization or filtering of issue content before it is processed by the AI subagent.
Mitigation: The risk is significantly reduced by a mandatory human validation step in Phase 3, requiring the user to explicitly approve every action before it is executed.

issue-triage