The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes data from GitHub issues and pull requests (bodies, titles, comments), which are attacker-controlled external sources. This content could contain malicious instructions designed to subvert the agent's logic during the "Evidence" logging process.
Ingestion points: Data is ingested via the gh issue list and gh pr list commands in scripts/fetch.sh and passed back to the agent context.
Boundary markers: Absent. The instructions in SKILL.md do not mandate the use of delimiters (e.g., XML tags or triple backticks) to separate untrusted issue content from the agent's instructions.
Capability inventory: The skill possesses the ability to execute shell scripts (fetch.sh, evidence-log.sh) and perform network operations via the gh CLI.
Sanitization: No evidence of filtering, escaping, or validation of the retrieved issue/PR body content exists before it is quoted and logged.
[COMMAND_EXECUTION]: The skill relies on executing local shell scripts (scripts/fetch.sh, scripts/evidence-log.sh) and a Node.js script (scripts/run-state-check.js). While these scripts appear to be part of the skill's distribution, they represent a surface for local command execution based on agent-provided arguments.

github