The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of reading and acting upon data from an external issue tracker. \n- Ingestion points: The agent reads the 'map' issue body, ticket questions, and resolution comments from a remote repository's issue tracker (SKILL.md). \n- Boundary markers: There are no explicit instructions or delimiters defined to separate untrusted issue content from the agent's operational instructions, nor are there warnings to ignore embedded commands within tickets. \n- Capability inventory: The skill possesses the ability to create, close, and label issues, assign users, and invoke subagents like /research and /prototype which can perform further file system and network operations. \n- Sanitization: The instructions do not prescribe any validation, filtering, or escaping of the content retrieved from the issue tracker before it is incorporated into the agent's reasoning process.\n- [NO_CODE]: The skill consists entirely of markdown instructions and YAML configuration files. It does not include executable scripts (e.g., Python, JavaScript, or Shell), which significantly reduces the risk of direct malicious code execution or persistence mechanisms within the skill package itself.

wayfinder