The Agent Skills Directory

[SAFE]: The skill implements a human-in-the-loop workflow for all state-changing operations. Steps 8 and 9 explicitly require user confirmation before creating or modifying milestones, issues, or labels, preventing unauthorized or accidental modifications to the project repository.- [PROMPT_INJECTION]: The skill processes data from external sources such as forge issues and project documents, which represents a surface for indirect prompt injection. However, this is the primary purpose of the skill, and the risk is effectively mitigated by the strict confirmation gates that prevent the agent from taking action based on potentially malicious instructions found in the ingested data.- [COMMAND_EXECUTION]: The skill utilizes the 'gh' CLI tool and forge access to retrieve project evidence. This usage is transparent and limited to data retrieval for analysis, conforming to the intended functionality without evidence of arbitrary command execution or privilege escalation.

roadmap-review