The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection. Several workflows ingest untrusted data from GitHub and feed it directly into AI prompts without sanitization.
Ingestion points: Untrusted content enters the agent context from git diff output in ai-review.yml, issue.title and issue.body in issue-triage.yml, and raw comment text in mention-bot.yml.
Boundary markers: Absent. The prompts interpolate external data directly (e.g., Diff: ${{ steps.diff.outputs.diff }}) without delimiters or instructions to ignore embedded commands.
Capability inventory: The AI has the ability to add labels, post comments, create PR reviews, and fail CI/CD deployments via the GitHub API.
Sanitization: No escaping or validation of the ingested external content is performed before prompt interpolation.
[COMMAND_EXECUTION]: The auto-rebase.yml workflow template includes commands for git push --force-with-lease. Although this is a standard Git operation for rebasing, it is a high-privilege action that can modify repository history if the automation is triggered maliciously or fails.
[EXTERNAL_DOWNLOADS]: The skill templates reference several common and official GitHub Actions including actions/checkout, actions/github-script, actions/stale, and slackapi/slack-github-action.

github-workflow-automation