The Agent Skills Directory

Indirect Prompt Injection Consideration: The skill implements a discovery protocol where the agent reads .squad/manifest.json files and GitHub issue content from external repositories. This behavior creates a potential surface for indirect prompt injection if a manifest file or issue body contains malicious instructions intended to influence the agent's behavior.
Ingestion points: Data enters the context via .squad/manifest.json files from org repositories and gh issue view output.
Capability inventory: The agent can execute gh issue create, squad-discover, and squad-delegate to perform cross-repository actions.
Sanitization: While the skill provides clear guidelines on what not to share (secrets, internal state), it does not explicitly define automated sanitization for the content ingested from external manifests.
Command Execution: The skill utilizes both standard tools like the GitHub CLI (gh) and specialized vendor tools (squad-discover, squad-delegate) to manage cross-squad tasks. These tools are used for their intended purpose of orchestration and task delegation.

cross-squad