The Agent Skills Directory

[Command Execution]: The skill uses gh (GitHub CLI) and git commands to fetch project metadata such as PR lists, statuses, and commit logs. This is essential for its primary purpose of tracking software projects.
[Data Ingestion Surface (Indirect Prompt Injection)]: The skill reads external content from GitHub (PR bodies, comments) and other project documents. To mitigate risks from untrusted data, the instructions explicitly mandate entity-encoding (e.g., < to <) and JSON escaping (\u003c) to prevent Cross-Site Scripting (XSS) or script injection within the generated HTML artifact.
[State Management]: A JSON state block is embedded in generated artifacts to track changes between refreshes. The skill includes instructions to treat this as a machine-readable boundary and safely parse it during updates.
[External References]: The skill references standard domains like claude.ai for artifact hosting and github.com for source data. These are aligned with the skill's intended software development workflow.
[Prompt Injection Safeguards]: The skill includes explicit instructions to treat all fetched content as data to be summarized rather than instructions to be followed, which serves as a defensive measure against indirect prompt injection.

project-artifact