The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources such as branch names, pull request details, and issue comments. This untrusted data is then used to construct shell commands for the agent to execute, creating an attack surface for indirect prompt injection.\n
Ingestion points: scripts/plan.sh fetches branch names from merged PRs using gh pr list, and scripts/stale-claims.sh extracts branch names from issue comments.\n
Boundary markers: The skill lacks explicit boundary markers or instructions for the agent to sanitize or quote the retrieved data before using it in shell commands.\n
Capability inventory: The skill instructs the agent to perform actions like git push origin --delete <branch> and gh issue edit using the ingested data.\n
Sanitization: No sanitization or escaping of the branch names or issue identifiers is implemented before they are interpolated into the shell command templates provided in SKILL.md.\n- [COMMAND_EXECUTION]: The instruction template git push origin --delete <branch> in SKILL.md is susceptible to shell command injection. If a branch name contains shell metacharacters (e.g., ;, backticks, or $()), the agent's shell will execute the injected command when it attempts to delete the branch. Similar risks exist for the gh issue close and gh issue edit instructions which use identifiers and references fetched from the repository tracker.

cleanup-merged-branches