The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted data from GitHub issue titles and bodies to generate PRDs and task plans. This creates a surface for indirect prompt injection where an attacker could embed malicious instructions in an issue to manipulate the agent's code implementation or analysis behavior.
Ingestion points: Phase 1 (SKILL.md) invokes analyze-issue to read external data from GitHub issues.
Boundary markers: No explicit delimiters are used in the orchestration logic to isolate instructions from the issue content.
Capability inventory: The skill has access to shell execution, filesystem read/write, and git operations via sub-skills.
Sanitization: While branch names are slugified, the core issue content is directly analyzed and transformed into executable task plans.
[COMMAND_EXECUTION]: The skill interpolates the ISSUE_NUMBER directly into shell commands and file paths (e.g., gh issue view {ISSUE_NUMBER}, git checkout -b issue/{ISSUE_NUMBER}-..., and mkdir -p issues/{ISSUE_NUMBER}/...). If a malicious user provides a non-numeric string designed to break out of the shell command or traverse the directory structure, it could lead to unauthorized command execution or file system access, although LLM-based extraction usually mitigates this by focusing on numeric patterns.

resolve-issue