The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because its core operating rules (in both SKILL.md and AGENTS.md) direct the agent to read and follow an AGENTS.md file located within the repository being managed. This allows the content of a potentially untrusted file to override the agent's default behavior.\n
Ingestion points: The skill ingests untrusted data from the repository's AGENTS.md file using the read command in scripts/github_knowledge_skill.py.\n
Boundary markers: There are no boundary markers or instructions to ignore embedded commands when the agent reads the AGENTS.md file.\n
Capability inventory: The skill has significant capabilities, including reading, writing, moving, and deleting files in a repository via the gh CLI, as well as local filesystem access.\n
Sanitization: The skill does not perform any validation or sanitization of the content within AGENTS.md before adopting it as operating instructions.\n- [COMMAND_EXECUTION]: The Python script scripts/github_knowledge_skill.py executes system commands using the gh (GitHub CLI) utility.\n
Evidence: Subprocess calls in GitHubKnowledgeManager.run_gh_command use subprocess.run with list-formatted arguments, which prevents shell injection by ensuring parameters are handled as distinct arguments rather than part of a shell string.\n
Scope: The command execution is limited to operations supported by the GitHub CLI and target specific repositories provided by the user or found in the local configuration file.

obsidian-gh-knowledge