The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands such as git clone and gh api using parameters (URLs, owners, and repository names) provided by the user. This creates a potential surface for command injection if the agent does not adequately sanitize these inputs.
[INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves reading and analyzing files from external, potentially untrusted repositories, which introduces a risk of indirect prompt injection.
Ingestion points: The skill reads README.md, package.json, and various files in the .github/ directory from the target repository.
Boundary markers: There are no explicit instructions or delimiters defined to separate the untrusted repository content from the agent's internal instructions.
Capability inventory: The skill possesses the ability to clone repositories, perform API calls to GitHub, and write audit files to the local file system.
Sanitization: The instructions do not mandate any specific sanitization or filtering of the ingested content before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to download repository content and fetch metadata from GitHub. These operations target a well-known service and are consistent with the skill's stated purpose.

dx-roaster