The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's reproduction workflow for bugs explicitly instructs the agent to "run tests/commands" provided in the ticket. This allows an untrusted issue reporter to execute arbitrary commands on the agent's system, leading to full system compromise.
[DATA_EXFILTRATION]: The skill reads from ~/.claude/afk.json to obtain tracker coordinates and repository mappings. Accessing sensitive files in the user's home directory outside the scope of the repository is a significant data exposure risk.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its processing of untrusted data from issue trackers and repository documentation.
Ingestion points: Issue titles, bodies, and comments from external trackers; repository knowledge vault (docs/<repo>-vault/_index.md); and out-of-scope records (.out-of-scope/*.md).
Boundary markers: None; there are no instructions to the agent to treat external content as untrusted or to isolate it from its own logic.
Capability inventory: File system access (read/write), network interaction with GitHub/Linear APIs, and execution of shell commands/tests.
Sanitization: None; the skill does not specify any validation, escaping, or filtering of the content ingested from the external sources.

triage