The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of 'specs' and 'tickets' provided by the user. This content is used to brief sub-agents and drive implementation logic. If these inputs contain malicious instructions, they could influence the behavior of the sub-agents (e.g., TDD, code review, or ship-it judge). \n- Ingestion points: User-provided specs and tickets passed via args to the Workflow engine. \n- Boundary markers: The skill does not explicitly define delimiters or instructions to ignore embedded commands within the input specs. \n- Capability inventory: The workflow executes file system operations (worktree, branch, commit), tool calls (/open-pr, /ship-it), and spawns sub-agents (agent() calls). \n- Sanitization: No sanitization or validation steps are defined for the input work items before they are incorporated into agent briefs.\n- [DYNAMIC_EXECUTION]: The skill's primary function is to 'author a script' that dynamically translates sub-skill orchestration (like loops and carried state) into executable control flow for a Workflow engine. While this follows a structured pattern (Implement, Polish, PR, Ship), the generation of executable logic from variable user-provided context introduces complexity and potential for logic manipulation.

work-on