The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses python3 -c to execute inline Python code that processes JSON output from GitHub CLI commands. Placeholders such as <number> and <candidates> are interpolated directly into the Python source text. This pattern is vulnerable to arbitrary code execution if these placeholders are not strictly validated as integers, as a malicious value could escape the intended logic and execute arbitrary Python commands.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external GitHub issues and markdown files to determine its implementation steps, creating a vulnerability surface for indirect prompt injection. A malicious actor with access to the project's issue tracker could inject instructions that the agent would then implement as part of the codebase. [Ingestion points]: GitHub issue bodies fetched via gh issue view and decision record files in docs/decisions/. [Boundary markers]: None; the skill instructs the agent to parse the content and extract tasks without specifying protective delimiters or instructions to ignore embedded commands. [Capability inventory]: The skill has broad capabilities including file system modification, shell command execution (pnpm, git, gh), and network communication via the GitHub CLI. [Sanitization]: No sanitization or validation of the extracted implementation plan is performed before the agent begins executing the specified tasks.
[COMMAND_EXECUTION]: The workflow executes various shell commands (gh, git, pnpm) using parameters derived from project metadata and user input. The interpolation of variables like <feature-slug> and <milestone-title> into shell contexts presents a risk of command injection if the values are not strictly sanitized by the agent.

build-feature