The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is configured to automatically execute a local Python script with arguments generated by the AI model based on its analysis of the current project.
Evidence: SKILL.md Phase 6 (GitHub Integration) specifies the execution of python3 scripts/deferred_capture.py for high-scoring suggestions.
Risk: The instructions explicitly state that this script "runs automatically without prompting the user," bypassing the standard human-in-the-loop security model for shell operations. Additionally, the referenced script scripts/deferred_capture.py is not provided in the skill package, making its behavior unverifiable.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local environment which is then used to form the arguments for the automated command execution.
Ingestion points: SKILL.md Phase 1 identifies "Code artifacts," "Documentation," and "Git history" as primary data sources.
Boundary markers: There are no specific delimiters or instructions to ignore embedded malicious content provided for these ingestion points.
Capability inventory: Automated shell command execution (scripts/deferred_capture.py) and GitHub issue creation.
Sanitization: The skill does not define any sanitization, escaping, or validation steps for the suggestion title or description before they are passed to the shell.
Risk: An attacker could place malicious instructions or shell metacharacters in a repository's documentation or comments. If the AI extracts these as part of a "feature suggestion," it could lead to arbitrary command execution when the capture script is invoked automatically.

feature-review