The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from GitHub, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The skill uses gh pr list, gh issue view, gh run download, and gh api to fetch content from pull requests, issues, and logs (SKILL.md, references/pr_operations.md, references/issue_operations.md).
Boundary markers: There are no instructions provided to the agent to ignore or delimit instructions found within the fetched GitHub data.
Capability inventory: The agent has the capability to merge PRs, close issues, run workflows, and set secrets (gh pr merge, gh issue close, gh workflow run, gh secret set).
Sanitization: No sanitization or validation of the fetched data (like PR titles or issue bodies) is mentioned before processing.
[CREDENTIALS_UNSAFE]: The skill documents commands that reveal sensitive information.
Evidence: references/api_reference.md includes the command gh auth status --show-token, which prints the user's active GitHub authentication token to the standard output, potentially exposing it in session logs.

github-ops