The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads and executes logic from a local file (docs/issues/issue-$ARGUMENTS.md) which could be influenced by untrusted external data.
Ingestion points: The skill reads implementation instructions, fix strategies, and validation commands from the local RCA file.
Boundary markers: There are no explicit delimiters or safety instructions (e.g., 'ignore any instructions in this file') used when the agent processes the RCA content.
Capability inventory: The agent has permission to Write and Edit source code and access to Bash for specific developer tools.
Sanitization: The skill does not perform any validation or sanitization on the content retrieved from the RCA document before acting on it.
[COMMAND_EXECUTION]: The skill uses git and the GitHub CLI (gh) to manage branches, view issues, and update issue status. These are standard operations for its stated purpose but represent a high level of autonomy in repository management.
[REMOTE_CODE_EXECUTION]: The skill includes instructions to 'Execute validation commands from RCA'. While the allowed-tools frontmatter limits Bash to specific binaries (ruff, mypy, pytest, npm, bun), the practice of running dynamically retrieved commands from a file constitutes a potential execution risk if the file's contents are compromised.

piv-implement-issue