The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process untrusted data from external sources such as UAT feedback, bug reports, and support escalations.
Ingestion points: Raw feedback content is parsed in Step 1 and used to populate various templates in Step 2 and Step 4.
Boundary markers: The skill instructions lack explicit boundary markers or warnings to the agent to disregard instructions potentially embedded within the user feedback.
Capability inventory: The skill possesses the ability to create and modify GitHub issues and project board items using the gh CLI (Steps 4 and 5).
Sanitization: There is no evidence of sanitization or escaping of the ingested content before it is interpolated into issue bodies and titles, creating a risk that malicious feedback could manipulate the agent's behavior during the triage process.
[COMMAND_EXECUTION]: The triage protocol relies on bash script templates for project board management and issue creation.
The scripts in Step 0 and Step 5 use environment variables and shell command substitution (e.g., git remote get-url, sed, jq) to derive project metadata.
In Step 5, placeholders like [ISSUE_NUMBER], [TYPE], and [PRIORITY] are meant to be filled by the agent and executed in a shell environment. If the agent does not properly escape these values—which are derived from the external feedback—it could lead to command injection within the agent's execution context.

feedback-triage