The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and acts upon untrusted data from GitHub issues and comments to drive core workflow operations.
Ingestion points: GitHub issue bodies and comment streams, as described in SKILL.md, delivery-units.md, and local-cleanup.md.
Boundary markers: The system uses specific markdown headers (e.g., ## Implementation, Cleanup: required) and fenced JSON blocks to delimit authoritative instructions, though these do not fully prevent adversarial content from influencing the agent's interpretation.
Capability inventory: The agent can perform GitHub API operations (via gh api), Docker container and volume management (via docker-compose), and local file system analysis.
Sanitization: Validation logic exists in review-attestation.sh to enforce canonical data formats, and local-cleanup.md provides explicit negative constraints (e.g., forbidding prune or globs) to mitigate command injection risks.
[COMMAND_EXECUTION]: The skill provides instructions and a bash script (review-attestation.sh) for the agent to execute shell commands. These include gh api for GitHub interactions, docker-compose for local resource cleanup, and git for diffing commits. These tools are used for their intended workflow purposes, but provide a powerful execution capability that relies on the accuracy of the input data.

and-workflow-contract