The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local shell commands and a bundled bash script (scripts/tickets.sh) to inspect repository state and interact with issue tracker APIs. It also allows users to configure and execute project-specific validation commands.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external issue trackers (GitHub, Linear, and Jira). It implements a robust defense against indirect injection by explicitly instructing the agent to treat all external tool output and document content as data rather than authoritative instructions.
[DATA_EXFILTRATION]: While the skill communicates with external APIs for GitHub, Linear, and Jira, these are well-known services and the communication is required for the skill's primary functionality. The skill provides clear transparency by warning users that diffs will leave the local machine when the peer-review feature is enabled, and it relies on standard environment variables for credential management rather than hardcoding secrets.
[DYNAMIC_EXECUTION]: A bundled shell script executes an embedded Python block to handle complex JSON and API logic. This Python code includes security-hardened features such as a custom redirect handler that restricts redirects to the same origin via HTTPS.

attune