The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest untrusted data from external sources, creating a potential surface for indirect prompt injection. Ingestion points: The skill utilizes commands like gh issue view, gh pr view, gh pr diff, gh run view --log, and gh search code to fetch content from GitHub issues, PRs, logs, and codebases (SKILL.md). Boundary markers: There are no instructions or delimiters provided to ensure the agent differentiates between data and instructions when processing external content (SKILL.md). Capability inventory: The agent is given access to sensitive capabilities including gh pr merge, gh repo create, gh ssh-key add, and arbitrary gh api calls (SKILL.md). Sanitization: The skill does not provide instructions for sanitizing or filtering external content before it is processed by the agent (SKILL.md).
[COMMAND_EXECUTION]: The skill is built around the execution of the gh CLI tool. While the commands described are standard for GitHub management, the range of operations—including local file system interaction (cloning, configuring mcp.json), modifying authentication keys (gh ssh-key add), and making network API calls—represents a significant command execution surface that necessitates user oversight (SKILL.md).

github