The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from external trackers (Linear) and source control (GitHub) and interpolates it into prompts for other AI agents. These 'executor' agents are given broad instructions (e.g., 'read it and follow it literally') and significant capabilities, such as code modification, git operations, and running database batteries. A malicious user could craft a Linear issue description or PR comment to hijack the agent's behavior.
Ingestion points: scripts/implement-issue.sh (issue descriptions and comments), scripts/fix-pr.sh (GitHub review threads), scripts/subreview-pr.sh (PR diffs and metadata).
Boundary markers: The skill uses minimal delimiters when including external content, which increases the risk that instructions embedded in that content will be interpreted as system commands.
Capability inventory: The agents can modify the filesystem, push to remote repositories, execute shell commands (vitest, eslint), and perform database operations (supabase reset).
Sanitization: No significant sanitization or validation of the ingested data is performed before it is placed into agent prompts.
[COMMAND_EXECUTION]: The framework relies heavily on shell scripts (scripts/auto-merge.sh, scripts/implement-issue.sh, etc.) to automate the development lifecycle. These scripts execute a variety of commands including git worktree, git push, gh pr create, and python3. While these are legitimate orchestration tasks, the autonomy of the system means these commands could be influenced by injected instructions.
[DATA_EXFILTRATION]: The skill accesses sensitive local files and credentials to perform its functions, including the Linear API key (~/.linear_api_key), .env.local files, and local database connection strings. This information is processed and potentially sent to the Linear and GitHub APIs as part of the orchestration logic.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to api.linear.app and github.com using curl, gh, and Python's urllib.request. These interactions are used to synchronize state between the local work environment and external management tools. Both are well-known technology services and are considered trusted sources for the purpose of this skill's intended functionality.

epic-captain