The Agent Skills Directory

Indirect Prompt Injection Surface: The skill provides tools to read content from GitHub, such as issue comments, pull request bodies, and file contents. This data originates from external users and could potentially contain instructions intended to influence the agent's behavior. The skill mitigates this by providing structured tool outputs and encouraging the use of an approval flow for any subsequent actions the agent might take.
Write Safety and Approval Flow: A core component of the skill is its 'Approval Control' mechanism. By default, write operations (like merging a pull request or creating a comment) require user confirmation. This 'human-in-the-loop' pattern is a best practice for agents with the capability to modify external state.
Least Privilege via Presets: The skill implements tool presets (e.g., repo-explorer, issue-triage, code-review) that allow developers to limit the agent's access to only the specific GitHub APIs required for its role, rather than exposing the full suite of 84 tools by default.
Credential Management: The skill utilizes the GITHUB_TOKEN environment variable for authentication. Instructions correctly advise using fine-grained Personal Access Tokens (PATs) to limit scope and warn against committing secrets to version control.
Internal Search Utility: The provided Python script (scripts/search_references.py) is a local development utility for searching reference documentation. It includes defensive measures such as basic path validation to ensure it only reads from the intended directory and a regex-based filter to strip common prompt injection patterns from its output.

github-tools-agents