The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to use several CLI tools to verify the state of the workspace and process history logs.
Evidence: Mentions of ls -t and grep for searching transcripts, and the use of git and gh for verifying PRs and branches in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it ingests and processes data from external, potentially attacker-controlled sources.
Ingestion points: The skill reads from chat transcripts, source control records, issue trackers, chat/issue channels, documentation, and error tracking systems as described in SKILL.md.
Boundary markers: The instructions include a requirement to "sanitize private context before any public output" and to use a specific "unslop" tool for final output formatting.
Capability inventory: The skill utilizes file system tools (ls, grep), version control tools (git, gh), and the ability to spawn parallel subagents to process large volumes of data.
Sanitization: While the skill mentions sanitization of private context, there are no explicit instructions for handling or escaping untrusted natural language instructions embedded within the ingested data.

recall