The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the official GitHub CLI (gh) for all issue interactions and git for codebase analysis. It includes proactive checks for the presence and authentication status of the gh tool before proceeding.
[EXTERNAL_DOWNLOADS]: The skill downloads issue attachments (images/mockups) directly from GitHub's official asset domains (user-images.githubusercontent.com and github.com/user-attachments/assets). These downloads use the user's local gh auth token to ensure appropriate permissions and prevent unauthorized access.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from GitHub issue bodies and comments. It mitigates this risk by utilizing parallel subagents for isolated requirement verification and enforcing strict markdown-based boundary markers (indented blocks) when rendering evidence, reducing the likelihood of embedded instructions affecting the agent's logic.
[DATA_EXPOSURE]: The skill explicitly protects local privacy by grounding all code searches against a committed git tree snapshot. It specifically avoids reading unstaged, untracked, or sensitive environment files (like .env) by using git show and git grep scoped to a specific tree ID rather than the physical disk.

audit-ticket