The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from GitHub issues using the gh issue view tool.
Ingestion points: External issue content retrieved from GitHub via the gh CLI (Step 2 and 3).
Boundary markers: The instructions do not define explicit delimiters or "ignore embedded instructions" warnings to isolate the untrusted issue text from the agent's instructions.
Capability inventory: The skill has access to powerful tools including Bash, Write, Read, Glob, Grep, and the Agent tool for spawning sub-agents.
Sanitization: There is no mention of sanitizing or escaping the ingested issue content before it is processed by the LLM.
[COMMAND_EXECUTION]: The skill uses the Bash tool to interact with the GitHub CLI (gh issue view, gh pr list).
The issue identifier supplied in $ARGUMENTS is passed to shell commands. If the platform does not strictly sanitize these arguments, it could present a command injection surface.
The skill contains a specific security-conscious constraint: it explicitly instructs sub-agents to avoid using grep -r or find to prevent the traversal of sensitive files like .secret.local which are governed by deny-list rules.

research