The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to interact with the local git environment and the gh (GitHub) CLI. These operations are restricted to read-only repository inspection and fetching issue data, which is aligned with the skill's stated purpose. The execution environment uses shell=False for security.
[EXTERNAL_DOWNLOADS]: Fetches issue and comment data from GitHub via the gh api command. This uses the authenticated gh CLI environment and targets the official GitHub API.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub issues (titles, bodies, comments). It mitigates injection risks by explicitly instructing the agent to treat this content as untrusted and providing a structured rubric (references/planning-rubric.md) and validation script (scripts/check_issue_plan.py) to separate remote claims from verified local observations.
Ingestion points: scripts/fetch_github_issues.py (fetching from GitHub API).
Boundary markers: The output handoff file uses specific sections like ## Issue Claims (Untrusted) to isolate remote data.
Capability inventory: Subprocess calls are limited to git and gh. The skill is explicitly read-only regarding the target repository and GitHub.
Sanitization: The validation contract ensures that untrusted content is isolated and that local evidence (F-n records) is verified against the repository state.

scope-issue