The Agent Skills Directory

External Dependency Integration: The skill instructs the installation of several packages, including @github-tools/sdk and @github-tools/eve-extension.
Context: These packages are maintained by the trusted vendor vercel-labs and are necessary for the skill's core functionality.
Evidence: SKILL.md and reference files recommend pnpm add @github-tools/sdk ai zod and @github-tools/eve-extension.
Indirect Prompt Injection Surface: The agent is designed to read external data from GitHub, such as issue bodies, pull request descriptions, and comments, which could potentially contain instructions aimed at the AI.
Context: This is an inherent consideration for any tool that processes community-generated content. The skill provides guidance on using truncated summaries and human-in-the-loop approval processes to mitigate this risk.
Ingestion Points: Tools for reading issues, PRs, and comments (e.g., getIssueContext, getPullRequestContext).
Boundary Markers: The documentation recommends using the summary detail level to truncate large bodies.
Capability Inventory: The skill includes powerful write capabilities such as mergePullRequest and createIssue.
Sanitization: The skill recommends manual approval flows (requireApproval) for destructive operations.
Local Utility Script: The skill includes a Python script (scripts/search_references.py) to assist the user or agent in navigating the documentation.
Context: The script performs local file reads and includes built-in protections to prevent directory traversal outside the skill's directory.
Evidence: scripts/search_references.py uses resolve() and a path prefix check to ensure it only accesses the intended reference files.

github-tools-agents