The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted data from GitHub issues and comments in SKILL.md. This creates an indirect prompt injection surface where an attacker can influence agent behavior by embedding instructions in an issue report.
[COMMAND_EXECUTION]: In SKILL.md, the instructions for bug reproduction direct the agent to "run tests, execute commands" based on the "reporter's reproduction steps." This provides a mechanism for an untrusted actor to trigger execution of arbitrary commands in the agent's environment.
[DATA_EXFILTRATION]: The skill's ability to execute commands, combined with its access to the repository and the GitHub CLI (gh), creates a path for exfiltrating sensitive information such as environment variables or codebase contents if an injection attack occurs.
[PROMPT_INJECTION]: Indirect Prompt Injection Analysis:
Ingestion points: GitHub issue bodies and comments are read and parsed in SKILL.md (Step 1: Gather context).
Boundary markers: Absent; there are no instructions to use delimiters or ignore instructions within the issue content.
Capability inventory: Execution of arbitrary shell commands and tests (SKILL.md), file system modification (.out-of-scope/), and network-capable GitHub operations via gh CLI.
Sanitization: Absent; the skill does not specify any validation or filtering of reproduction steps before they are executed by the agent.

github-triage