The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from GitHub Pull Request descriptions and review comments which could contain malicious instructions for the agent.
Ingestion points: Content is retrieved from the GitHub API in scripts/gh-pr-info at lines 31 (PR body), 72 (Review bodies), and 107 (Comment bodies).
Boundary markers: The script uses visual delimiters (e.g., ═════ and ─────) but does not include explicit instructions to the agent to ignore or isolate instructions contained within the external text.
Capability inventory: The skill is primarily read-only, using gh api and gh repo view. It does not possess capabilities for file writing, network exfiltration to non-GitHub domains, or arbitrary shell command execution based on the fetched content.
Sanitization: The script outputs raw strings via jq without filtering for potential prompt injection patterns or escape sequences.
[COMMAND_EXECUTION]: The scripts/gh-pr-info script constructs GitHub API paths and GraphQL queries using unsanitized input arguments, which could lead to manipulation of the API requests.
Evidence: The variable $PR_NUMBER is interpolated directly into a GraphQL query string at line 76 and line 111, and $REPO is interpolated into API URL paths at lines 31 and 47. If an agent is tricked into providing non-integer values or path-traversal strings (e.g., ../..), it could result in the agent accessing unintended GitHub API endpoints or performing unintended queries.

github-pr-workflow