The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it ingests and processes content from external, third-party controlled sources.
Ingestion points: The skill fetches GitHub issues (gh issue view), pull requests (gh pr view), and performs web research (research.md), all of which can contain malicious instructions hidden in prose, comments, or diffs.
Boundary markers: The skill explicitly instructs the agent in SKILL.md (Core Principle 7) to treat fetched content as data, not instructions, and to ignore directions to run commands or touch credentials found within such content.
Capability inventory: The agent possesses capabilities to execute shell commands (tests, linting), perform git operations, write files, and access the network.
Sanitization: Mitigations include mandatory user consent for executing any code from PR forks, using isolated git worktrees for reviews to prevent environment contamination, and instructions to avoid putting sensitive data into search queries.
[COMMAND_EXECUTION]: The skill is designed to execute development-related shell commands inferred from the project or defined in local configuration (.devflow/check.md).
Evidence: It runs test suites, linters, and build tools (e.g., npm run test, pytest, cargo build) and a specific OpenSpec validation script (opsx-validate.sh) copied into the repository during setup.
[DYNAMIC_EXECUTION]: The skill uses filesystem discovery to dynamically locate and delegate tasks to other skills related to the OpenSpec tool.
Evidence: In references/dev.md and references/openspec.md, it uses ls -d ./.[!.]*/skills/openspec-* to identify available planning and implementation skills, selecting the appropriate one based on the current task rather than hardcoding paths.
[DATA_EXPOSURE]: The research workflow facilitates fetching external documentation and technical information.
Evidence: references/research.md warns the agent never to put secrets, credentials, environment values, or non-public code into URLs or search queries during the research process.
[EXTERNAL_DOWNLOADS]: The skill references and encourages the installation of the @fission-ai/openspec CLI and various project-level dependencies.
Evidence: It provides instructions for global installation of @fission-ai/openspec@latest and uses standard package managers (npm, pip, cargo, etc.) for project setup, while specifically warning against an abandoned 'openspec' package to prevent typosquatting attacks.

devflow