The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements a workflow that fetches untrusted data from GitHub issue titles and bodies via gh issue list and instructs the agent to autonomously implement these requirements. This creates a vulnerability to indirect prompt injection.
Ingestion points: Issue data retrieved from the GitHub API in SKILL.md.
Boundary markers: The instructions lack boundary markers or specific directives for the agent to ignore or isolate instructions embedded within the issue bodies.
Capability inventory: The agent has permissions to modify local source code, execute arbitrary build and test commands (e.g., go build, go test), and invoke sensitive operations through /ship-it.
Sanitization: No sanitization, validation, or safety filtering is applied to the retrieved issue content before it is processed by the agent.
[PROMPT_INJECTION]: The skill contains explicit instructions to ignore specific tool availability errors ("不要尝试用 Skill 工具调用 goal... 也不要因找不到 /goal 而中止循环"), which overrides standard error-handling behavior for missing tools.
[COMMAND_EXECUTION]: The implementation loop involves executing build, test, and lint commands (e.g., go build, go test, go vet) on the project's source code. Because this code is modified based on instructions from untrusted GitHub issues, a malicious issue could result in the execution of harmful commands embedded in build scripts or test suites.

loop-it