The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and synthesizing large amounts of untrusted data from multiple external sources, creating a significant attack surface for indirect prompt injection.
Ingestion points: Untrusted content is retrieved from GitHub PR descriptions and comments, Linear ticket details, Notion documentation, Slack chat history, Datadog telemetry logs, Sentry error reports, and Databricks SQL query results.
Boundary markers: The prompt templates (investigator-prompt.md and synthesizer-prompt.md) instruct the agent to use 'verbatim quotes' and a specific citation framework. While these structure the output, they do not include robust security delimiters (like XML tags or clear boundary markers) to prevent the model from inadvertently following instructions embedded within the sourced text.
Capability inventory: The skill possesses broad capabilities, including the execution of shell commands (git, gh) and access to multiple SaaS platform APIs. Notably, the skill explicitly states that sub-agents are 'general-purpose' and 'not read-only' (SKILL.md Step 3), which significantly increases the risk if an injection occurs.
Sanitization: The provided instructions do not include mechanisms for sanitizing, escaping, or filtering the content retrieved from external platforms before it is processed by the AI models.
[COMMAND_EXECUTION]: The skill uses local CLI tools, specifically git (for log, blame, and show operations) and the GitHub CLI (gh pr view), to establish context for its investigation (SKILL.md Step 2). These commands target well-known services and are expected behaviors for a software development assistant.

why