The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted GitHub issue descriptions and user comments, creating a potential surface for indirect prompt injection attacks.
Ingestion points: External text fields ({body} and {last_5_comments}) are fetched from GitHub repositories and interpolated directly into the subagent prompt in SKILL.md during Phase 2.
Boundary markers: The untrusted content is enclosed under a **Body**: markdown header, but there are no explicit system constraints or boundary delimiters instructing the subagent to ignore instructions or jailbreaks contained within the issue text.
Capability inventory: The skill possesses write capabilities on the repository, including posting comments (gh issue comment), modifying labels (gh issue edit), and closing issues (gh issue close).
Sanitization: No automatic content filtering or sanitization is applied to the issue bodies. However, the risk is heavily mitigated because the skill strictly requires human verification via AskUserQuestion before any automated draft is executed, and it utilizes single-quoted heredocs (<<'COMMENT_EOF') to completely prevent shell command substitution.

issue-triage