The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute a variety of local scripts and CLI tools. It performs repository operations using the gh (GitHub CLI) and manages internal polling states by writing to files in the /tmp directory. It also executes helper scripts (poll-worker.sh, poll-reviewer.sh) to manage long-running worker tasks.
[EXTERNAL_DOWNLOADS]: The skill interacts with an external orchestration API defined by the $PYLOT_API environment variable. It uses curl to spawn remote LLM workers, send prompts to them, and poll for status updates. These requests are authenticated using a Bearer token provided in the $PYLOT_DISPATCH_TOKEN variable. This behavior is the primary intended function of the skill for developer orchestration.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from GitHub issues and repository metadata, which are then passed to remote workers. While the skill uses python3 -c "import json; print(json.dumps(...))" to serialize payloads for the remote API, it performs direct shell expansion of input arguments (such as the issue number $0 and repository name $1) inside the command-line strings before they reach the Python serializer. This pattern creates a potential injection surface if the input arguments are manipulated by a malicious actor or a compromised upstream agent.
Ingestion points: Skill arguments $0 (issue-number) and $1 (org/repo), as well as GitHub issue content fetched via gh issue view (SKILL.md).
Boundary markers: The skill lacks boundary markers when interpolating arguments into initial shell commands but uses JSON encoding for the secondary communication with remote workers.
Capability inventory: The skill possesses Bash execution privileges, network access via curl, and repository access via gh credentials.
Sanitization: Sanitization is partial; it relies on json.dumps for API payloads but uses unsafe shell interpolation for local command construction.

speckit-runner