The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and acts upon untrusted data from GitHub PR bodies and comments.
Ingestion points: Fetches PR descriptions, inline diff comments, and conversation-tab comments via gh pr view and gh api as defined in references/address-review-feedback.md.
Boundary markers: Instructions lack explicit mention of markers to delimit untrusted data when passing it to the soia-dev-fix-loop dependency.
Capability inventory: The skill has access to sensitive operations including gh api (PUT/DELETE) for permission management, gh pr merge, and git push.
Sanitization: No documented sanitization or filtering of external comment text prior to processing.
[COMMAND_EXECUTION]: The skill performs various repository operations by executing shell commands via the GitHub CLI.
Evidence: Frequent use of gh api, gh pr merge, gh release create, and git push throughout SKILL.md and the reference manuals.
Mitigation: A comprehensive Safety Model is implemented, mandating explicit user confirmation for high-impact operations like collaborator permission changes and branch deletions.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading and installing tools and dependencies from the vendor's infrastructure.
Evidence: Installation procedures using claude plugin marketplace and npx targeting soia-team repositories in SKILL.md.
Note: These resources are managed by the skill's official author (soia-team) and represent expected functionality.

soia-dev-github-ops