The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted external data that could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The skill reads project-specific files (code paths, tests, contribution guidance) and performs web searches for "current evidence" to drive its implementation logic (Steps 2 and 3).
Boundary markers: The instructions do not specify any delimiters or safety markers to differentiate between the agent's core instructions and the untrusted data being processed.
Capability inventory: The skill has broad capabilities including filesystem modification (Step 7), execution of project-specific commands (Step 13), use of the GitHub CLI (gh) for remote operations (Step 14), and general network access.
Sanitization: There are no explicit sanitization or validation steps mentioned for data retrieved from web searches or repository files before it is used to generate code or execute commands.
[COMMAND_EXECUTION]: The skill requires and uses several local command-line tools to perform its tasks.
Evidence: It explicitly requires git and the GitHub CLI (gh). Furthermore, it is instructed to run "real project commands" and repository gates (Step 13), which involves executing arbitrary scripts or binaries defined within the target codebase.
[EXTERNAL_DOWNLOADS]: The skill is configured to access external resources.
Evidence: The skill requires "network access" and is mandated to "perform and record web search" to gather evidence before proposing implementation options. It also uses the GitHub CLI to interact with remote repositories.

implement-idea