The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from a YAML file and interpolates it into the instructions for a subagent.
Ingestion points: The agent-tasks.yml or agent-tasks.yaml file parsed in Phase 1.1 provides the TASK_DESCRIPTION.
Boundary markers: The subagent prompt defined in Phase 3.3 lacks explicit delimiters (like XML tags or multi-line separators) or specific instructions to treat the task description as data rather than command instructions.
Capability inventory: The subagent has permissions to read, write, and edit the codebase, while the parent agent can push changes and create GitHub pull requests using mcp__github__create_pull_request.
Sanitization: There is no evidence of filtering, escaping, or validation of the TASK_DESCRIPTION before it is passed to the subagent.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands to manage the working environment and repository state.
Evidence: Git operations such as git clone, git fetch, git push, and git checkout are executed in Phases 2 and 3.
Evidence: Phase 5 performs a cleanup using rm -rf "$WORKDIR", where the target directory is computed dynamically via a Python one-liner or environment variable.

task-agent