The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple external sources, including issue trackers (Jira, Linear, GitHub), pull request bodies, and local plan files. These inputs are used to drive autonomous decision-making in the engineering pipeline, creating a significant surface for indirect prompt injection attacks.
[DYNAMIC_EXECUTION]: In references/shipping.md, the skill allows project-level documentation to override the default shipping process by specifying a "named skill or command" to be executed non-interactively. This enables the execution of arbitrary logic defined within a project's own files, which could be exploited if an attacker modifies the project's instructions.
[COMMAND_EXECUTION]: The skill autonomously executes a variety of shell-level operations, including Git commands (git remote, git push, git rev-parse) and GitHub CLI commands (gh pr view, gh issue create). These operations are performed without manual confirmation, relying on the agent's interpretation of the request and context.
[DATA_EXFILTRATION]: The skill's primary function involves transmitting sensitive data, such as source code and internal diagnostic reports, to external destinations including Git remotes and issue trackers. While this is the intended behavior, the autonomous nature of these transmissions represents a potential exfiltration path if an attacker successfully hijacks the routing or destination configuration via indirect injection.

lfg