The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes data from untrusted external sources.
Ingestion points: The skill fetches the body and comments from external issue URLs and reads context from the local codebase (SKILL.md, Steps 1 and 2).
Boundary markers: There are no explicit instructions to use delimiters or ignore instructions embedded within the fetched external content.
Capability inventory: The skill performs codebase exploration, writes local files to the .issues/ directory, and publishes data to external issue trackers (SKILL.md, Steps 2 and 5).
Sanitization: The instructions do not specify sanitization or validation of the external content before it is processed by the agent.
[DATA_EXFILTRATION]: The skill reads local codebase information and publishes derived summaries to external project management services like GitHub or Linear (SKILL.md, Step 5). This behavior is consistent with the skill's primary purpose and involves well-known services.
[COMMAND_EXECUTION]: The skill interacts with the local file system to write ticket files under the .issues/ directory and invokes a specialized tool to generate effort estimates (SKILL.md, Steps 4 and 5).

to-tickets