The Agent Skills Directory

[PROMPT_INJECTION]: Indirect prompt injection surface identified. The skill is designed to ingest and analyze untrusted external content as part of its core triage function.
Ingestion points: Reads issue titles, bodies, comments, receipts, attachments, and pull request diffs (documented in Process step 2).
Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded within the ingested issue data.
Capability inventory: The skill has the ability to read and write workflow state through the ai-native-backend-contract, including updating stage-state, writing triage notes, and modifying work records (documented in Process step 4).
Sanitization: No explicit sanitization or filtering of external content is described before interpolation into the triage process.
Assessment: This ingestion surface is a functional requirement for the skill's purpose. The risk is considered low given the specialized nature of the triage outputs and the requirement for user confirmation on non-routine or ambiguous actions.
[SAFE]: The skill implements strong safety boundaries and least-privilege principles. It explicitly prevents implementation, review, or release actions (Boundaries section) and requires human confirmation for destructive actions like closing records without clear prior authority (Confirmation Gates). All backend interactions are scoped through a formal contract (ai-native-backend-contract).

issue-triage