The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically identifies and executes project-specific scripts and CI commands to verify code changes.
Evidence in SKILL.md: "Find the commands that prove a change in this repo: the project's saved T3 Code scripts first, then what CI runs."
Evidence in SKILL.md: "Run each check yourself, as its own command... with its output in a log file outside the repo."
Evidence in SKILL.md: "run the project's setup there" (on the integration branch).
Risk: The agent autonomously discovers and runs shell commands defined in the target repository's configuration. A malicious repository could define dangerous commands in its setup or test scripts that the agent would then execute with its current permissions.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from task descriptions, external tickets, and the existing codebase, which could contain malicious instructions.
Ingestion points: The /work <task> command in SKILL.md, ticket specifications in the Plan phase, and code diffs/specifications in prompts/reviewer.md.
Boundary markers: No explicit delimiters or instructions to ignore embedded instructions are used when passing these inputs to the subagent briefs (Explorer, Implementer, Reviewer, Diagnoser).
Capability inventory: Across its various files, the skill can write files, perform git operations (commit, merge, push), and execute arbitrary shell commands via the "Verify" step.
Sanitization: There is no evidence of sanitization or validation of external content (tasks/tickets) before it is interpolated into agent prompts.
Risk: An attacker could craft a ticket or code comment that, when processed, instructs the subagents to deviate from their intended roles, such as exfiltrating data via the push mechanism or modifying files outside of the intended task scope.

work