The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external issue trackers (e.g., GitHub, Linear) and uses it as the functional specification for its autonomous development cycle. This creates a surface for indirect prompt injection where malicious issue content could attempt to influence the agent's implementation or review decisions.
Ingestion points: External issue titles, bodies, and comments, as well as pull request review findings.
Boundary markers: Absent; the prompts in workflow.js interpolate the tracker data directly into the agent's context without isolation delimiters or instructions to ignore embedded commands.
Capability inventory: The agent can execute git commands (commit, push, merge, worktree), write to the local file system (~/.afk/), and manage PRs via the GitHub CLI.
Sanitization: No sanitization or validation of the tracker content is performed before it is used to drive the development workflow.
[COMMAND_EXECUTION]: The workflow involves automated execution of shell commands, specifically using git and the GitHub CLI (gh) to manage repository state, handle worktrees, resolve conflicts, and push code changes.
[EXTERNAL_DOWNLOADS]: The skill connects to external issue tracking services to fetch task metadata and project requirements, which is a standard part of its intended autonomous operation.

afk