The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill represents a significant indirect prompt injection surface as it is designed to ingest and process untrusted data from multiple sources.
Ingestion points: SKILL.md (Step 2) explicitly instructs workers to fetch issue content (title, body, labels, comments) and 'fetch referenced URLs'.
Boundary markers: The instructions do not define strict boundary markers or 'ignore embedded instructions' warnings for the data being ingested from external sources.
Capability inventory: The skill has extensive capabilities, including executing shell commands via Bash, making network requests via curl, and performing file system writes and Git operations across multiple scripts (SKILL.md, poll-worker.sh, poll-reviewer.sh).
Sanitization: There is no evidence of sanitization or filtering of the external content before it is interpolated into prompts for the producer or reviewer workers.
[COMMAND_EXECUTION]: The skill executes repository-owned discovery and execution (Step 4.5). It reads task/spec files and repository instructions (contributor, agent, build, CI, test) and executes discovered commands directly in the supervisor checkout. This is a primary function of the skill but carries risk if the target repository is untrusted.
[DATA_EXFILTRATION]: The skill uses several environment variables ($PYLOT_DISPATCH_TOKEN, $PYLOT_API) for authentication against a gateway. These credentials are passed to subprocesses and are accessible within the supervisor checkout where repository-discovered commands are executed, creating a risk of credential exfiltration if a malicious command is discovered in a compromised repository.

speckit-runner