The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub issue bodies, titles, and comments, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The skill uses mcp__github__list_issues, mcp__github__get_issue, and mcp__github__search_issues as defined in SKILL.md to bring external content into the context.
Boundary markers: The instructions do not define clear delimiters (e.g., XML tags or triple backticks) or specific "ignore embedded instructions" warnings for the agent to apply when handling issue content.
Capability inventory: The skill has access to the Bash and Write tools, along with administrative GitHub tools (mcp__github__update_issue, mcp__github__add_issue_comment), which could be leveraged if an injection is successful.
Sanitization: No explicit instructions for sanitizing or validating the ingested content are present in the skill definition.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform operations via the GitHub CLI.
Evidence: The pre hook in SKILL.md executes gh auth status, and the batch operations example demonstrates the use of Bash to run gh issue create commands.

agent-issue-tracker