The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes an externally provided "plan" (e.g., from do-issue) to extract branch and slice names, creating a vulnerability surface where malicious input could influence agent actions.
Ingestion points: Reads ordered slices from a written plan (SKILL.md, Step 2).
Boundary markers: None. The skill does not implement delimiters or explicit "ignore embedded instructions" warnings when processing the plan data.
Capability inventory: Subprocess execution of git commands (git checkout -b, git version, git log) and optional jj CLI commands (SKILL.md, Steps 1, 3, and 4).
Sanitization: There is no mention of sanitizing or validating the extracted slice names to ensure they do not contain malicious shell metacharacters or escape sequences before being interpolated into commands.
[COMMAND_EXECUTION]: The skill directs the agent to execute shell commands using variables (${STACK}, ${BASE}, ${SLICE_NAME}) derived from the plan. Without proper escaping or validation of these variables, an attacker providing a malicious plan could achieve command execution (e.g., a slice name like feature; rm -rf /).

stack-create