The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingest untrusted data from GitHub issues and comments which could contain malicious instructions intended to manipulate the agent's response.
Ingestion points: gh issue view $ARGUMENTS and gh issue view $ARGUMENTS --comments in SKILL.md are used to retrieve the issue body and all existing comments.
Boundary markers: The skill does not define delimiters or provide instructions to the agent to treat the retrieved issue content as data rather than instructions, increasing the risk of the agent following commands embedded in comments.
Capability inventory: The skill has the capability to write back to the repository using gh issue comment in SKILL.md, which could be used to exfiltrate data or spread malicious instructions if the agent is compromised.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from GitHub before it is processed by the agent.
[COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (gh) to interact with issues. It passes user-provided arguments ($ARGUMENTS) directly into shell commands. If the platform execution environment does not strictly validate these arguments, it could potentially allow for command injection by providing malformed issue identifiers.

issue-reply