The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data that could contain hidden or adversarial instructions designed to override agent behavior during the workflow execution.
Ingestion points: The skill ingests data from GitHub Project (v2) boards via the gh-project-sync tool and Pull Request review comments via the pr-reviewer and review-fixer sub-agents (referenced in SKILL.md and adr/0001-invoke-workflow-via-skill-not-agent.md).
Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore embedded instructions within the project cards or PR comments being processed.
Capability inventory: The skill possesses the Bash tool and orchestrates tools (task-agent, review-fixer) that can write files, create/update GitHub issues and PRs, and interact with the filesystem.
Sanitization: The skill delegates validation to downstream tools, but does not explicitly specify sanitization of natural language content extracted from GitHub project cards or comments before interpolation into subsequent prompts.
[DYNAMIC_EXECUTION]: The skill requires the agent to dynamically construct execution paths and argument strings at runtime.
Evidence: In SKILL.md (Step 2 and Step 3), the agent is instructed to resolve ${CLAUDE_PLUGIN_ROOT} to an absolute path and assemble a Skill tool call by concatenating the workflow path with user-supplied key=value arguments.
Risk: While standard for workflow orchestration, assembling command strings from runtime variables and user-controlled data presents a risk of argument injection if not strictly handled by the workflow runner.

auto-board-task