The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from GitHub issues and pull requests, creating a surface for indirect prompt injection attacks where malicious content in an issue could attempt to override subagent instructions.
Ingestion points: External data is ingested in SKILL.md (Phase 1) and scripts/gh_fetch.py using gh issue list, gh pr list, and gh pr view commands to retrieve titles, bodies, and comments.
Boundary markers: The subagent prompts in SKILL.md lack explicit delimiters or escaping for the {body} and {comments_summary} variables, making it difficult for the LLM to distinguish between developer instructions and untrusted data.
Capability inventory: The skill utilizes task_create and task to spawn background agents, Write to create files in /tmp/, and various read tools (Grep, Read, git, gh). A successful injection could lead to the exfiltration of codebase information or environment details into the generated reports.
Sanitization: There is no evidence of sanitization or validation performed on the GitHub content before it is used to generate prompts.
[DYNAMIC_EXECUTION]: The orchestrator skill dynamically generates instructions for subagents by interpolating runtime data into prompt templates. These prompts are then executed via the task tool, which is a standard pattern for multi-agent orchestration but increases the impact of any injected content.
[COMMAND_EXECUTION]: The skill relies on shell commands and a Python script (scripts/gh_fetch.py) to execute gh CLI and git operations. These commands are used to automate the collection of repository metadata and issue backlogs.

github-triage