The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data by reading GitHub issues (gh issue view --comments) and pull request lists (gh pr list). This creates a surface for indirect prompt injection where an attacker could embed malicious instructions in an issue or PR description to influence the agent's actions.
Ingestion points: The skill reads external data via gh issue view, gh pr list, and local repository files like plan/STATUS.md.
Boundary markers: The instructions lack explicit boundary markers or specific warnings to ignore embedded commands within the fetched GitHub content.
Capability inventory: The skill has access to powerful tools including git, gh (GitHub CLI), cargo (Rust build tool), and solidcraft-cli. It can perform file writes, project builds, and network operations to GitHub.
Sanitization: No specific sanitization, escaping, or filtering of the content retrieved from GitHub is performed before it is presented to the agent context.
[COMMAND_EXECUTION]: The skill frequently uses shell commands to manage the development environment and project lifecycle.
Evidence: Usage of gh, git, rustup, cargo, and solidcraft-cli to perform administrative and development tasks.
Mitigation: The skill enforces a human-in-the-loop policy, requiring the user to approve every public action (forking, pushing, PR creation) and review all proposed content, which significantly mitigates the risk of unauthorized command execution.

solidcraft-contributing