The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with and process data from external GitHub resources like issue bodies, pull request descriptions, and comments. This creates a surface where an attacker could embed malicious instructions in those resources to influence the agent's behavior.
Ingestion points: Operations in SKILL.md, references/issue-management.md, and references/pr-workflows.md involve fetching and reading external text via gh issue view, gh pr view, and gh api calls.
Boundary markers: The skill does not explicitly instruct the agent to ignore instructions embedded within the fetched data, though it uses technical delimiters like heredocs (EOF) for shell script safety.
Capability inventory: The skill utilizes the Bash tool for shell execution and the gh CLI for creating and editing GitHub resources, which could be leveraged if an injection is successful.
Sanitization: There is no evidence of explicit sanitization or filtering of external content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill relies heavily on the Bash tool to execute gh CLI commands. It uses variable interpolation in shell scripts (e.g., in SKILL.md and examples/automation-scripts.md), which requires careful handling of untrusted input to avoid command injection at the shell level. The skill mitigates this by recommending the use of heredocs for multi-line content.

github-operations