The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external, collaborative sources (issue trackers) to guide its logic and tool selection.
Ingestion points: The agent reads the ## Notes and ## Destination sections from a 'Map' issue (stored in docs/map.md, GitHub, or Jira) and the ## Question field from individual ticket issues. These sources are externally editable and untrusted.
Boundary markers: There are no explicit instructions to the agent to treat issue content as untrusted or to ignore instructions embedded within these sections. The prompt explicitly allows 'Notes' to 'override' existing logic and 'carry execution into the map itself.'
Capability inventory: The agent can perform file read/write operations in the docs/ directory, execute commands using the GitHub CLI (gh), interface with Jira via the Atlassian MCP, spawn sub-agents for research, and invoke various functional skills like /prototype and /grilling.
Sanitization: The skill does not validate or sanitize content retrieved from the issue tracker before using it to influence its execution path.
[COMMAND_EXECUTION]: The skill uses the gh CLI to automate issue management. While this is a standard developer tool, the agent's use of it is driven by potentially untrusted data from the issue tracker, which could be exploited by an attacker to manipulate repository state or perform actions on the user's behalf.

wayfinder