The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection as it ingests untrusted data from external sources to generate tasks and execute commands.
Ingestion points: In SKILL.md (Step 1: Gather context), the skill is instructed to fetch and read the full body and comments of issues from external URLs or specification paths provided by the user.
Boundary markers: There are no explicit instructions to use delimiters or to ignore embedded instructions within the external content being processed.
Capability inventory: The skill possesses the ability to write files to the .scratch/ directory and execute GitHub CLI (gh) commands to create and modify issues.
Sanitization: The skill lacks explicit sanitization or validation steps for the content retrieved from external trackers before it is used to draft new tickets.
[COMMAND_EXECUTION]: The skill relies on executing shell commands to interact with issue trackers.
Evidence: SKILL.md (Step 5 and 6) explicitly directs the agent to use gh issue create and gh issue edit to manage tickets on GitHub.

to-tickets