The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (GitHub issues and PR titles) which could potentially contain malicious instructions. However, the skill includes explicit instructions for the agent to only use the information for routing and never auto-run the recommended skill, which effectively mitigates the risk.
Ingestion points: Phase 1b in SKILL.md reads PR and issue titles/labels via the gh CLI.
Boundary markers: The skill contains explicit instructions: "Not for executing work — only for routing", "Do not use /help: To actually run the recommended skill", and "Never auto-run the recommendation."
Capability inventory: Operations are limited to reading state and presenting a recommendation. No destructive or network-exfiltrating capabilities are present in this skill.
Sanitization: Input is handled by standard CLIs (git, gh) and a local utility script using safe jq argument passing.
[COMMAND_EXECUTION]: The skill executes local shell commands and a bundled utility script (sidecar.sh) to gather repository state and manage project metadata. These operations are within the expected scope of a development-oriented orientation skill and do not involve untrusted remote code.

help