The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to triage and process external requests, which creates a surface for malicious instructions embedded in bug reports or PRs.
Ingestion points: SKILL.md Stage 0 (Triage) reads body, comments, and diffs from external issues and pull requests.
Boundary markers: Lacks explicit delimiters for input processing, though it requires an AI-disclosure notice for its own posted comments.
Capability inventory: Access to git operations, issue tracker APIs (gh, glab), and shell execution for code verification.
Sanitization: No automated sanitization is specified; the skill relies on "Static Review First" and explicit human approval before any execution.
[REMOTE_CODE_EXECUTION]: The skill facilitates the execution of code from untrusted external PRs to verify functionality or bug fixes.
Evidence: SKILL.md contains a "Verify Claims" section that allows running untrusted code after static review and human approval.
Mitigation: The instructions mandate the use of a "Security Sandbox" that is disposable, lacks credentials, and has restricted network access by default.
[COMMAND_EXECUTION]: The skill utilizes several CLI tools to interact with the repository and hosting platforms.
Evidence: Explicit use of git status, git push, gh issue create, gh api, and glab api for ticket publishing and state management.

vibe-plan