The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from GitHub issues and pull requests, which represents an indirect prompt injection surface.
Ingestion points: External data is ingested via the gh CLI in scripts/github-inbox-report.mjs and the triage workflow in references/triage.md, which reads issue bodies, comments, and pull request diffs.
Boundary markers: The skill provides explicit instructions in references/triage.md to treat external text as untrusted evidence, to never obey instructions within the text, and to include an AI disclaimer on all outputs.
Capability inventory: The skill possesses the ability to read and modify GitHub issue/PR metadata (labels, comments, state) and involves a bug reproduction step that could potentially execute code.
Sanitization: There is no programmatic sanitization or filtering of the ingested data; the skill depends on the agent adhering to its safety instructions.
[COMMAND_EXECUTION]: The skill executes the GitHub CLI (gh) and a bundled Node.js script. The script uses execFileSync with an array of arguments, which prevents shell-based command injection from user-supplied filters like --owner or --repo.

github-inbox