The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from Aporia tickets, including markdown descriptions, comment threads, and file attachments (HTML, Markdown). This content is used to plan and execute code changes, presenting a risk that malicious instructions embedded in a ticket could influence the agent's behavior.
Ingestion points: Data enters the context via aporia:pull_item (item body, rationale, and comments) and aporia:read_attachment (text-based files) as defined in SKILL.md.
Boundary markers: The instructions in SKILL.md lack specific requirements for using delimiters or "ignore embedded instructions" headers when handling external ticket content.
Capability inventory: As described in SKILL.md (Phases 3 and 4), the agent has the authority to perform repository modifications (git branching, file editing), execute shell commands for testing, and modify external records via aporia:update_item and aporia:resolve_items.
Sanitization: No explicit sanitization or validation of the ingested content is performed before it is used for planning or code implementation.
[COMMAND_EXECUTION]: The workflow in SKILL.md involves executing local shell commands for git operations (Phase 3) and for implementing and testing code changes (Phase 4). While these are standard development tasks, they represent a capability that could be misused if the agent's instructions are overridden via indirect injection.

aporia-work