The Agent Skills Directory

[PROMPT_INJECTION]: Static analysis heuristic flags regarding instruction overrides are false positives. The text in references/constraints-warnings.md and references/security-protocol.md contains examples of prompt injections purely for defensive documentation purposes, teaching the agent how to recognize and safely ignore malicious external instructions.
[INDIRECT_PROMPT_INJECTION]: The skill interacts with untrusted user-generated content from GitHub issue bodies, presenting an inherent injection surface. However, it incorporates a comprehensive, multi-layered isolation protocol that successfully mitigates this risk.
Ingestion points: Untrusted issue metadata and body content enter the context through gh issue view execution in SKILL.md and references/phases-detailed.md.
Boundary markers: The skill explicitly instructs the agent to treat the issue text as pure data rather than commands and to discard any embedded instructional directives.
Capability inventory: The skill possesses code modification capabilities via the Write and Edit tools, and shell command capabilities via the Bash tool to run test suites (npm test, pytest, etc.).
Sanitization: A strict human-in-the-loop gate is implemented at Phase 2, where the raw content is only displayed as read-only text, and the user must explicitly confirm the exact requirements in their own words before any code is explored or written.
[SAFE]: No hardcoded credentials, unauthorized network exfiltration, or malicious persistence mechanisms are present. The skill strictly follows development best practices by guiding users to manage secrets via environment variables and execute tasks safely through local workflows.

github-issue-workflow