The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of rpce-cli and git to perform repository operations, including binding context, building selections, and generating diff files. It also provides instructions to execute installed command-line tools for design validation when authorized by the user.
[DATA_EXFILTRATION]: Repository source code, local diffs, and project documentation are transmitted to external 'Oracle lanes' (LLM providers) for review. While this is the intended core functionality of the skill, it involves sending potentially sensitive internal code to third-party services.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from PR bodies, issue descriptions, and upstream documentation to provide context for the Oracles, which could contain malicious instructions.
Ingestion points: Originating issues, PR bodies, and investigations are read in Step 1 of SKILL.md. Current upstream documentation and source code for external protocols/APIs are read in Step 2.
Boundary markers: There are no explicit markers or delimiters defined in the prompt construction instructions to isolate untrusted data from the instructions sent to the Oracles.
Capability inventory: The skill environment has the capability to execute shell commands via rpce-cli and git, and it can write files to the repository's tmp/ and prompt-exports/ directories.
Sanitization: The instructions include a manual step for the user/agent to 'Exclude credentials, tokens, private user data' before transmission in Step 3, but there is no automated filtering or escaping of the ingested text content.

fable-deslop