The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests issue titles, bodies, and error stack traces from external platforms (GitHub, Sentry, Linear). This data is considered untrusted and could contain malicious instructions intended to manipulate the agent or sub-agents during the triage and dispatch phases.
Ingestion points: GitHub issue list/details, Sentry unresolved issue events, and Linear active issues (via MCP or API fallback).
Boundary markers: The skill uses AskUserQuestion to confirm auto-resolutions, which provides a human-in-the-loop checkpoint, but lacks explicit sanitization instructions for the context passed to fix agents.
Capability inventory: The skill can execute shell commands (Bash), perform network requests (WebFetch), and spawn sub-agents (Agent).
Sanitization: No explicit sanitization or escaping of external issue content is mentioned before it is displayed or passed to other tools.
[COMMAND_EXECUTION]: The skill uses Bash to iterate through repositories defined in a local registry file and performs operations like grep, git log, and gh CLI calls. While these are part of the intended triage functionality, they represent a broad execution capability on the local filesystem.
[EXTERNAL_DOWNLOADS]: The skill uses WebFetch to interact with Sentry and GitHub APIs when MCP tools hit quota limits or are unavailable. These requests target well-known services (sentry.io, api.linear.app) and are considered standard operational behavior for this use case.
[CREDENTIALS_UNSAFE]: The instructions reference sensitive tokens (SENTRY_AUTH_TOKEN, LINEAR_API_KEY, GITHUB_TOKEN) and their resolution via Doppler or environment files. The skill follows standard security practices by instructing the agent to resolve these from secure stores or .env files rather than hardcoding them.

ops-triage