The Agent Skills Directory

[PROMPT_INJECTION]: The skill acts as an ingestion point for untrusted data, which creates a vulnerability surface for indirect prompt injection.
Ingestion points: Data is pulled from Pull Request comments (Step 1), Linear issues and comments (Step 3), Slack thread content (Step 4), and Notion page content (Step 7).
Boundary markers: Delimiters like  are used for parsing, but the skill also permits a fallback mechanism where an LLM extracts data from unstructured comments, which is more susceptible to manipulation.
Capability inventory: The subagent has access to bash, git, and MCP tools for reading from GitHub, Linear, and Notion.
Sanitization: The instructions require commit SHAs to be validated with a regex (/^[0-9a-f]{7,40}$/) before use in shell commands; however, the content of the gathered evidence is not sanitized.
[COMMAND_EXECUTION]: The skill executes git notes via bash using identifiers parsed from manifests found in PR comments. Although regex validation is requested, the reliance on the model to enforce this check during the parsing/extraction stage poses a risk of command injection if the validation is bypassed or flawed.
[DATA_EXFILTRATION]: The skill allows the retrieval of content from Notion and Slack based on URLs found in PR comments. This mechanism could be abused to trick the agent into accessing and exposing sensitive internal documents or discussions if an attacker can predict or provide URLs that the agent has permission to access.

collect-evidence