The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of reading and adhering to external repository content which may contain malicious instructions designed to manipulate the agent.
Ingestion points: The skill explicitly reads issue templates from .github/ISSUE_TEMPLATE/ and .gitlab/issue_templates/, and retrieves existing issue bodies and comments during update, query, and comment workflows (SKILL.md steps 3, 6, 8, and 9).
Boundary markers: There are no defined boundary markers or specific instructions to ignore or sanitize commands that might be embedded within the retrieved templates or issue content.
Capability inventory: The skill is granted access to the Bash tool with wildcards for gh and glab CLIs, allowing it to execute a wide range of commands that can modify repository state, access API endpoints via gh api, and interact with project metadata.
Sanitization: No sanitization or validation logic is present to filter or verify the integrity of the data fetched from external repository files before it is processed by the agent.

github-issues