The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes untrusted ticket files without sufficient isolation or boundary markers. A malicious ticket could contain instructions to override the agent's core logic.
Ingestion points: The skill reads markdown files from a user-specified folder in Phase 0 and Phase 2a.
Boundary markers: Absent. The instructions to the implementation and QA subagents do not include delimiters or warnings to ignore instructions found within the ticket content.
Capability inventory: The subagents have the ability to write to the filesystem, execute shell commands (via tests/lint/build), and perform Git operations (commit, push, PR).
Sanitization: No sanitization or validation of the ticket content is performed before it is passed to the subagent prompts.
[COMMAND_EXECUTION]: The skill's core workflow involves executing local shell commands for testing, building, and linting in an autonomous, unattended mode ('AFK contract'). This creates a risk where malicious code in the project's test suite or build scripts, or commands injected via a ticket, could be executed on the host system.
Evidence: Phase 2a and Phase 2e explicitly instruct subagents to run tests and verification commands to confirm the implementation is correct.
[DATA_EXFILTRATION]: While intended for collaboration, the Git integration to push branches and open PRs could be abused to exfiltrate local data if the agent is tricked into committing sensitive files.
Evidence: Phase 2g automates the branch creation, commit, and push process to a remote server to open a PR.

super-autopilote-ticket