The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local bash scripts provided within its package to perform core logic, such as pull request management and SVG generation.
Evidence: SKILL.md and references/attach.md instruct the agent to execute scripts/open-pr.sh and scripts/text-frame.sh using the bash interpreter.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from project files and git metadata, which could be manipulated to influence the agent's behavior or persona.
Ingestion points: The skill reads Persona: and Style: instructions from CLAUDE.md or AGENTS.md within the user's project; it also extracts ticket IDs from branch names, commit messages, and local ticket files in .scratch/.
Boundary markers: There are no explicit delimiters or "ignore embedded instructions" warnings described for when these extracted values are used within the agent's context.
Capability inventory: The skill has the capability to read and write files (using mktemp), perform network operations via the GitHub CLI (gh), and execute shell scripts.
Sanitization: While scripts/text-frame.sh performs XML-escaping for SVG output, the persona and style inputs read from project files are not explicitly sanitized before being adopted by the agent.

reveal