The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it retrieves and processes untrusted content from GitHub issues to drive its workflow.\n
Ingestion points: references/clarify.md and references/wrap-up.md ingest issue titles, bodies, and comments using the gh CLI.\n
Boundary markers: No specific boundary markers or instructions are present to ensure the agent treats external issue content strictly as data rather than instructions.\n
Capability inventory: The agent has access to the Bash tool, allowing for file system modifications and execution of git and GitHub CLI commands.\n
Sanitization: There is no evidence of sanitization or filtering of the ingested external content before it is used to generate implementation plans or PR descriptions.\n- [COMMAND_EXECUTION]: Several CLI command templates in the skill interpolate variables into double-quoted shell strings, which may allow for command injection if the metadata (like issue titles) contains shell metacharacters.\n
Evidence: references/draft-pr.md includes the command gh pr create --title \"<issue title>\", where the title is directly interpolated into the command line.\n
Evidence: references/clarify.md includes gh issue edit <number> --body \"<improved body>\", which presents a similar risk depending on the shell environment's handling of nested expansion.

ghpm-work