The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes data from external, untrusted sources (GitHub PRs and Linear tickets) that could contain malicious instructions designed to manipulate the agent's output.
Ingestion points: Fetches PR titles, bodies, and comments via gh pr view and Linear issue content via linear issue view.
Boundary markers: The instructions lack explicit delimitation or system instructions to ignore potential commands embedded within the fetched data.
Capability inventory: The skill has the ability to write to the file system (mktemp) and interact with external APIs via the linear and gh CLI tools.
Sanitization: There is no mention of automated sanitization or escaping of external content before it is interpolated into the final draft or CLI commands.
[COMMAND_EXECUTION]: The skill uses shell commands to interact with development tools, with some parameters being derived from external input.
Evidence: In Step 7, the command `linear issue create ... --title "[PRODUCT QA]
"` interpolates a feature summary derived from the PR or parent Linear issue. If the source content contains shell escape characters, it could lead to command injection if the agent does not handle the interpolation securely.
[EXTERNAL_DOWNLOADS]: The skill retrieves data from GitHub and Linear using their respective official CLI tools. These operations are performed on well-known services and are essential to the skill's primary function.

product-qa