The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes data from GitHub (pull request descriptions, comments, and notifications) which are attacker-controlled surfaces. While the skill focuses on structural guardrails, it lacks explicit instructions to ignore natural language commands embedded within this ingested data.
Ingestion points: Data enters the context via gh pr view, gh search prs, and gh api notifications.
Boundary markers: None identified. The skill does not instruct the agent to use delimiters or ignore embedded instructions when reading PR/issue content.
Capability inventory: The skill facilitates gh pr create/edit/comment and various gh api POST/PATCH/DELETE operations across multiple files.
Sanitization: The skill mandates the use of jq to build JSON payloads, which provides structural sanitization but does not filter the natural language content of the messages.
[COMMAND_EXECUTION]: The skill provides detailed instructions for executing shell commands and pipelines involving gh, jq, grep, and awk. It includes security-enhancing patterns such as unsetting GH_TOKEN and GITHUB_TOKEN environment variables when stored credentials are confirmed, preventing environment tokens from shadowing more restrictive stored credentials.
[SAFE]: The skill implements significant defensive measures, including enforcing mandatory organization scoping via $GITHUB_ORG to prevent accidental cross-organization actions and requiring a canonical, pinned attribution footer on all outbound messages to ensure transparency and auditability.

wk-gh