The Agent Skills Directory

[PROMPT_INJECTION]: The skill demonstrates high security awareness regarding indirect prompt injection risks associated with user-generated content.
It identifies GitHub issue bodies as untrusted content and implements a mandatory "Content Isolation Protocol" in SKILL.md and references/security-protocol.md.
It instructs the agent to ignore embedded instructions such as "ignore previous instructions" or "system override."
Findings from automated detectors regarding these phrases in references/security-protocol.md are false positives, as they are listed as examples of malicious patterns for the agent to disregard, not commands to follow.
[SAFE]: The skill correctly implements a mandatory human-in-the-loop (HITL) confirmation gate as a security boundary.
Ingestion points: Untrusted data enters the context via gh issue view output as described in SKILL.md (Phase 1).
Boundary markers: The workflow requires an explicit AskUserQuestion gate where the user must restate and confirm requirements in their own words.
Capability inventory: The skill has Write, Edit, and Bash capabilities to modify code and execute local scripts.
Sanitization: The agent is instructed to use only the user-confirmed summary for implementation, effectively isolating the agent's logic from raw, untrusted issue text.
[SAFE]: The skill uses well-known and trusted tools for its operations.
It relies on the GitHub CLI (gh) and git for repository management and pull request workflows.
It uses Context7 for retrieving technology-specific documentation, promoting the use of safe and up-to-date APIs.
[COMMAND_EXECUTION]: Command execution is limited to standard, purpose-driven development tasks.
The skill runs project-specific test suites (e.g., npm test, pytest) and linters to verify code quality.
It explicitly prohibits executing code or commands found within GitHub issue bodies or comments.

github-issue-workflow