The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub issue titles and bodies to drive its search and evaluation logic. An attacker could craft an issue description containing malicious instructions to manipulate the agent's behavior, such as forcing it to comment incorrectly or ignore actual duplicates.
Ingestion points: The workflow in SKILL.md (Step 1) and the prompt template in README.md extract the title and body of newly opened issues.
Boundary markers: There are no explicit delimiters (like XML tags or markdown blocks) or instructions to ignore embedded commands used when interpolating the issue content into the agent's context.
Capability inventory: The agent is granted repository access via a GH_TOKEN and uses the gh CLI to list, view, and comment on issues.
Sanitization: The skill does not perform any validation or sanitization on the extracted issue text before using it to generate search queries or determine duplication.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the gh CLI. While these operations are scoped to issue management, the command arguments (such as search strings) are derived directly from external, untrusted user input, which could lead to command manipulation if the agent is not sufficiently guarded against injection.

github-issue-dedupe