The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external GitHub issues, including titles, labels, and discussion threads. This creates a surface for indirect prompt injection where an attacker could embed malicious instructions in an issue that the agent might follow when triaging or commenting. • Ingestion points: The skill reads output from org-issues-scan.sh (which gathers GitHub issue metadata and content) in Phase 1. • Boundary markers: No specific delimiters or instructions are provided to the agent to isolate or ignore potentially malicious embedded instructions in the issue content. • Capability inventory: The agent has the ability to post comments to GitHub (gh issue comment) and execute shell commands (org-issues-scan.sh). • Sanitization: No explicit sanitization, validation, or escaping of the ingested issue content is mentioned before it is processed.
[COMMAND_EXECUTION]: The skill executes a local shell script located at ~/.claude/scripts/org-issues-scan.sh to gather issue data. It also references a command /setup-scripts to be run if the script is missing. While these tools appear to be part of the skill's infrastructure, executing scripts from hidden or absolute paths requires the environment to have these specific files pre-configured correctly.

org-issues-tidy