The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests potentially untrusted data from git diffs, GitHub pull requests, and local source files specified by the user. This data is passed as context to the delegated 'pi' agent. The skill attempts to mitigate risk by instructing the agent to use only read-only tools.\n
Ingestion points: git diff, gh pr diff, and @filepath references.\n
Boundary markers: None explicitly used beyond natural language framing in the task prompt.\n
Capability inventory: The skill uses Task to launch the agent, plus Bash, Read, Grep, and Glob for context collection.\n
Sanitization: No content sanitization or escaping is performed on the ingested code context.\n- [DYNAMIC_EXECUTION]: The skill implements a configuration resolution mechanism that supports environment variable expansion (e.g., $API_KEY) within JSON settings files. This is achieved using Bash indirect variable expansion. This is a standard and safe practice for managing credentials without hardcoding them in configuration files.\n- [COMMAND_EXECUTION]: The skill provides an --edit-config flag that invokes a system editor (defaulting to vi) to modify local settings. While editors like vi allow for shell escapes, the tool is used here for its intended purpose of text editing and is explicitly listed in the allowed tools.

review