The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to delegate tasks to an external AI agent (GitHub Copilot CLI), which creates an inherent attack surface for indirect prompt injection if malicious instructions are included in the task brief.
Ingestion points: The implementation brief passed via the --brief flag or stdin to the relay.mjs script.
Boundary markers: The skill instructions (in references/writing-the-brief.md) explicitly recommend using XML-style tags like <task>, <verification_loop>, and <action_safety> to structure and delimit the brief.
Capability inventory: The delegated Copilot agent can perform filesystem modifications and shell command execution within the target repository.
Sanitization: The skill includes a dedicated review-and-land.md guide that mandates a manual review of all diffs, re-running project tests/gates, and performing an 'implementer sweep' for common failure patterns before any changes are committed.
[COMMAND_EXECUTION]: The scripts/relay.mjs script executes the copilot and git binaries. It mitigates command injection risks by:
Validating shell-sensitive arguments (--model, --effort, --session) against a restrictive alphanumeric regex (SAFE_TOKEN).
Delivering the task brief via an @-prefixed file path rather than passing content directly through command-line arguments.
Using safe process spawning methods and properly quoting file paths for the shell on Windows systems.

copilot-delegate