The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from GitHub issues using gh issue view and act upon it by writing code and executing commands. It lacks explicit boundary markers or sanitization for this external content, creating a surface for indirect prompt injection. An attacker with the ability to comment on or open issues could embed instructions to exfiltrate data, bypass safety checks, or inject malicious code into the repository.
Ingestion points: Issue bodies and comments retrieved via gh issue view (referenced in SKILL.md workflow).
Boundary markers: Absent. The instructions do not specify how to distinguish between legitimate issue descriptions and adversarial instructions within the data.
Capability inventory: The agent has the ability to write to the file system, execute shell commands (build scripts, gh CLI), and perform network operations via the gh tool.
Sanitization: No sanitization or validation of the ingested issue text is mentioned.
[COMMAND_EXECUTION]: The workflow includes a 'Build gate' where the agent is instructed to 'confirm the app builds on each branch.' This involves executing project-specific build commands on code that has been modified or created based on external issue data. If the implementation includes malicious changes to build configurations (e.g., package.json scripts, Makefile), the agent will execute arbitrary code during the verification step. The risk is heightened by instructions that tell the agent to 'Work autonomously' and 'No user check-ins, no confirmation gates,' while also telling subagents to 'keep your reasoning... to yourself,' which suppresses transparency and user oversight.

batch-implement