The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from external issue trackers and the local codebase to drive its logic.
Ingestion points: Issue titles, descriptions, comments from GitHub, Jira, and Linear; and existing files within the repository.
Boundary markers: No explicit delimiters or instructions are provided to the agent to distinguish between its own system prompt and the content of the issues it reads.
Capability inventory: The skill can write to the filesystem, execute shell commands (via gh and local build tools), and perform network operations (GitHub API).
Sanitization: The instructions include a specific 'Guardrails' section prohibiting the exposure of secrets, tokens, or internal reasoning in comments/PRs, though it does not specify input sanitization techniques.
[COMMAND_EXECUTION]: The skill identifies and executes 'validation commands' defined in the repository being worked on (e.g., in README.md, Makefile, or package scripts). This represents a capability to run arbitrary code defined in the target codebase.
[EXTERNAL_DOWNLOADS]: The skill uses the authenticated gh CLI to interact with GitHub for status updates and PR creation. It also interfaces with Linear and Jira via their respective APIs/CLIs to fetch issue context.
[DATA_EXFILTRATION]: The skill communicates implementation progress and PR links back to the original issue trackers. These network operations are the intended primary function and are subject to guardrails against leaking sensitive information like credentials or private environment variables.

implementation