The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill ingests untrusted data from external repositories via the read_file function and possesses high-privilege write capabilities (commit_file, create_pull_request). This creates a high-risk surface where a malicious file from a repository could command the agent to perform unauthorized repository modifications.
Ingestion points: github_client.py:read_file allows the agent to read arbitrary file contents from external GitHub repositories.
Capability inventory: The skill enables file writing (commit_file), bulk file updates (commit_files), and Pull Request creation (create_pull_request).
Boundary markers: No specific delimiters or 'ignore embedded instructions' warnings are mentioned to prevent the agent from obeying instructions found inside read files.
Sanitization: No evidence is provided of content sanitization or filtering of external data before it enters the LLM context.
Credential Handling (MEDIUM): Instructions in credential-setup.md direct users to store plaintext GitHub Personal Access Tokens (PATs) in 'Project Knowledge' documents. This exposes the secret directly to the agent's prompt context, making it vulnerable to exfiltration via prompt injection attacks.
Unsafe Pattern (LOW): The setup guide provides a Python snippet for users to run that modifies sys.path to include local skill directories. While common for development, this practice can lead to execution of unintended local code if directories are misconfigured.

invoking-github