The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it retrieves and processes untrusted data from GitHub. \n
Ingestion points: Untrusted data enters the agent context via issue titles, issue bodies, pull request descriptions, and review comments, which are fetched using gh CLI and GitHub MCP in skills such as gh-issue, gh-triage, gh-pr-respond, gh-pr-status, and gh-mine. \n
Boundary markers: While input sanitization is defined for CLI arguments, the skill lacks explicit boundary markers or 'ignore embedded instructions' warnings for the external content displayed to the agent. \n
Capability inventory: The skill has significant operational capabilities, including executing git operations (push, merge, tag), gh repository management, and, crucially, modifying local source files in gh-pr-respond to 'apply suggested fixes' from review comments. \n
Sanitization: The skill documentation specifies rules to reject shell metacharacters and null bytes for fields like repository identifiers, labels, and usernames, which helps prevent direct command injection but does not mitigate instructions embedded in the external text itself.\n- [COMMAND_EXECUTION]: The skill relies on several bash scripts (activity-summary.sh, my-items.sh, release-notes.sh, repo-health.sh) to perform its functions. These scripts execute shell commands (git and gh) with parameters often derived from repository metadata or time ranges. While the parameters are constrained by the logic in the skill definitions, these scripts run within the local environment and interact with external repository data.

GitHub Workflow