The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted data from issue tracker descriptions and comments via commands like gh issue view and glab issue view as defined in REFERENCE.md. This ingestion surface is vulnerable to indirect prompt injection if an attacker places malicious instructions within an issue's content.
Ingestion points: Issue descriptions and comments fetched from GitHub or GitLab via CLI tools.
Boundary markers: Absent; the instructions do not specify the use of delimiters or 'ignore' instructions when parsing fetched issue text.
Capability inventory: The skill executes shell commands via npm test, gh, and glab, as well as repository-specific test runners identified in SKILL.md.
Sanitization: While the skill instructs the agent to sanitize outgoing reports to remove secrets, there is no requirement to validate or sanitize the ingested data from the issue tracker before processing.
[COMMAND_EXECUTION]: The skill performs shell command execution to run test suites and interact with issue trackers. It uses npm test, gh issue comment, and glab issue note to perform its core functions. While these are legitimate actions for a testing agent, they represent a significant capability that could be abused if the agent is successfully injected.
[DATA_EXFILTRATION]: The skill reads repository configuration and issue tracker data, and then posts formatted reports back to those external platforms. Although it contains explicit 'Non-Negotiable Rules' in SKILL.md to prevent the exposure of credentials, private data, or raw payloads, the functional capability to move data from the local environment to an external tracker is present.

smoke-tests