The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from various project files which could be used as an attack vector if those files contain malicious instructions.
Ingestion points: The agent is instructed to read AGENTS.md, TASKS.md, and task-specific documentation (e.g., docs/task/{ID}-{task-name}.md, docs/testing/, and docs/learnings/) within the SKILL.md workflow.
Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded within the data it reads.
Capability inventory: The skill has capabilities to execute shell commands (pnpm), write to files (TASKS.md), and perform version control operations (branch/PR creation).
Sanitization: There is no evidence of content sanitization or validation before the data is processed or interpolated into the pull request body.
[COMMAND_EXECUTION]: The skill executes local project commands including pnpm build, pnpm typecheck, pnpm lint, and pnpm test. These are standard development operations intended to verify the codebase before shipping, but they represent a surface for code execution if the project configuration is compromised.

ship