The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill is designed to ingest untrusted data from external sources (GitHub issues, PRs, and repository metadata).
Ingestion points: SKILL.md instructs the agent to use gh issue view, gh pr view, and gh repo view on URLs provided by users.
Boundary markers: Absent. There are no instructions to ignore or sanitize embedded instructions within the fetched GitHub content.
Capability inventory: The skill allows the agent to perform high-impact actions including git push, gh pr create, gh issue create, and gh api (arbitrary API access).
Sanitization: Absent. Content fetched from GitHub is used directly to inform agent actions.
Risk: An attacker could craft a GitHub issue or PR containing malicious instructions. If the agent views this resource, it may execute those instructions using its authenticated gh or git permissions (e.g., exfiltrating data via gh api or injecting code via git push).
Command Execution (LOW): The skill relies on executing local system commands (gh, git). While these are standard tools, their use is governed by instructions that can be manipulated by the data they process.

github