The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub issue titles and bodies, which could contain malicious instructions designed to influence the agent's behavior during the sync process.
Ingestion points: The skill fetches data using gh issue list across multiple scripts (sync-from-github.ps1, sync-from-github.sh, merge-old-xips.ps1, merge-old-xips.sh).
Capability inventory: The agent has the ability to write to the local filesystem (docs/proposals/xip/), delete local files, and create or modify GitHub issues via gh issue create and gh issue edit.
Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands when processing the issue body content.
Sanitization: The scripts use regex to extract IDs and titles, but the main markdown body is processed and written to files or other issues without sanitization.
[DYNAMIC_EXECUTION]: The skill uses shell scripts that execute embedded Python code at runtime.
Evidence: The files scripts/sync-from-github.sh and scripts/merge-old-xips.sh use the `python3
<<'PY'` pattern to run multi-line Python logic defined within the shell script. While this code is static and part of the skill, it represents a dynamic execution pattern.
[COMMAND_EXECUTION]: The skill relies heavily on executing shell commands to perform its duties, including filesystem management and GitHub interaction.
Evidence: Extensive use of the gh CLI for repository operations and PowerShell/Bash commands (e.g., Remove-Item, Get-ChildItem, find, mkdir) for local file management.

sync-xips