The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read incident data (titles, descriptions, comments) from GitLab using commands like glab incident view and glab incident list. This data is externally controlled and may contain malicious instructions designed to manipulate the agent's behavior. \n
Ingestion points: GitLab incident titles, descriptions, and comments are read into the agent's context through glab incident list and glab incident view (referenced in SKILL.md and references/commands.md). \n
Boundary markers: The skill lacks explicit boundary markers or instructions for the agent to ignore potentially malicious content within the incident data. \n
Capability inventory: The agent has the capability to execute shell commands (glab), perform network write operations to GitLab, and read local files using the --attach flag. \n
Sanitization: There is no evidence of sanitization or validation of the ingested incident content before it is processed by the agent. \n- [DATA_EXFILTRATION]: The skill documents the use of the --attach <path> flag for the glab incident note command, which allows uploading local files to GitLab incidents. While this is a legitimate feature of the glab CLI, it represents a data exfiltration vector if an attacker uses indirect prompt injection to trick the agent into uploading sensitive local files (e.g., .env, SSH keys) to a GitLab repository controlled by the attacker.

glab-incident