The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to execute arbitrary shell commands for quality checks as defined in Step 4. This includes executing Node.js tools (npx, tsc, eslint, vitest, jest), Python tools (mypy, ruff, pytest), and Rust tools (cargo). It also performs Git operations such as 'git checkout', 'git add', and 'git commit'. While these are standard for a coding agent, they represent a significant capability surface if directed toward malicious ends.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection via the task plan file (issues/{ISSUE_NUMBER}/tasks.json).
Ingestion points: The agent reads and follows instructions from the 'description' and 'acceptanceCriteria' fields of the JSON task plan.
Boundary markers: No explicit boundary markers or 'ignore' instructions are used when interpolating task data into the agent's context.
Capability inventory: The agent has the ability to write to any file in the repository, execute shell commands, and commit/push changes via Git.
Sanitization: There is no evidence of sanitization or validation of the input strings from the task plan before they influence the agent's implementation logic.
[DATA_EXFILTRATION]: While the skill includes a best-practice warning to avoid using 'git add .' to prevent accidental credential exposure, the agent possesses the underlying capability to read sensitive files (like .env or SSH keys) and incorporate their content into commits or progress logs if instructed to do so by a malicious task plan.

execute-tasks