The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from GitHub issues and pull requests, which could potentially contain malicious instructions intended to manipulate the triage process.
Ingestion points: Fetches title, body, and diff content from issues and PRs via gh CLI in SKILL.md and references/reviewing-prs.md.
Boundary markers: The skill relies on meta-instructions directing the agent to treat fetched text as data rather than instructions, though it does not use explicit structural delimiters.
Capability inventory: Possesses the ability to merge PRs, close issues, and edit PR bodies on GitHub.
Sanitization: Implements robust sanitization by ensuring untrusted text is never passed via shell interpolation; instead, it uses stdin (--body-file -) to prevent command execution vulnerabilities.
[COMMAND_EXECUTION]: Uses the Bash tool to execute git and gh CLI commands.
Evidence: Performs repository discovery and state modification using shell commands in SKILL.md.
Mitigation: Repository identifiers are validated against a strict regular expression (^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$) before being used as arguments, preventing arbitrary command injection via malicious remote URLs.

github-triage