The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, which creates a surface for indirect prompt injection attacks where malicious instructions could be embedded in the source material.
Ingestion points: The skill fetches context from issue bodies, comments, and external URLs or specification paths provided by the user (described in Step 1 of SKILL.md).
Capability inventory: The skill has the ability to explore the codebase, write files to the .scratch directory, and interact with external issue trackers like GitHub or Linear.
Boundary markers: There are no explicit instructions to the model to ignore embedded commands or markers within the ingested data.
Sanitization: There is no mention of input validation or sanitization for the content fetched from external sources.
Mitigation: The skill implements a manual review checkpoint in Step 4 ("Quiz the user") using the AskUserQuestion tool, which allows the user to inspect and approve the generated tickets before they are published to a tracker.
[DATA_EXFILTRATION]: The skill performs network operations to publish generated content to external platforms like GitHub and Linear. These are well-known services used for their intended purpose in the skill workflow and do not constitute an exfiltration risk in this context.

to-tickets