The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to create AI workflows that process untrusted external data.
Ingestion points: The workflows ingest PR diffs, changed file lists, issue titles, issue bodies, and commit messages (via git log) directly into AI prompts.
Boundary markers: The templates provided in the guide (e.g., Section 1.1 and 2.1) lack explicit delimiters or instructions to ignore embedded commands within the ingested data, making them susceptible to manipulation by attackers who submit malicious PRs or issues.
Capability inventory: The AI agents configured by these patterns have the ability to comment on issues, label PRs, modify repository settings, and perform git operations like rebasing and pushing code.
Sanitization: There is no evidence of sanitization or character escaping for the external data interpolated into the AI prompts in the provided templates.
[COMMAND_EXECUTION]: Several examples in the detailed guide demonstrate shell command execution involving untrusted metadata.
Section 4.2 provides a TypeScript example where commitHash and targetBranch are interpolated directly into backtick-enclosed exec calls. Without validation, this pattern is vulnerable to command injection if branch names or hashes are attacker-controlled.
Section 3.2 and 4.3 use the output of git commands (like git log or git for-each-ref) to drive logic that includes further shell operations, which could be exploited if the git environment contains malicious metadata.
[EXTERNAL_DOWNLOADS]: The guide references several external dependencies and tools.
GitHub Actions: Utilizes official and well-known actions such as actions/checkout, actions/github-script, actions/stale, and slackapi/slack-github-action.
NPM Packages: The automated review workflow incorporates the @anthropic-ai/sdk package for communicating with AI models.
These external references are to established services and organizations and are consistent with the skill's stated purpose of CI/CD automation.

github-workflow-automation