The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources.
Ingestion points: The workflow (Workflow Step 1, 2) ingests content from human-provided QA reports, issue descriptions, and pull request comments.
Boundary markers: The instructions do not define specific delimiters or "ignore previous instructions" markers for the ingested content.
Capability inventory: The skill uses standard developer tools including git for repository exploration (worktree management) and gh (GitHub CLI) for listing and commenting on issues. It is explicitly prohibited from editing source code or tests.
Sanitization: The skill mandates a robust sanitization process, requiring the agent to redact tokens, keys, cookies, session IDs, passwords, emails, and customer identifiers from evidence before it leaves the session.
[DATA_EXPOSURE]: The skill accesses local file systems (repository worktrees) and remote issue metadata. This risk is effectively mitigated by the 'Zero attribution' rule and the explicit 'Redact before anything leaves the session' rule which protects sensitive information like API keys and PII.
[SAFE]: The skill's configuration includes disable-model-invocation: true and a strict 'Never edits code' rule, significantly reducing the potential for malicious side effects during bug reproduction or classification.

qa-escape