The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a workflow that ingests data from untrusted external sources, creating a potential surface for indirect prompt injection attacks.
Ingestion points: The skill reads ticket and pull request content from external sources such as GitHub (using gh issue view or gh pr view) and Linear (via the read tool or API), as detailed in doctrine.md and SKILL.md.
Boundary markers: The instructions establish an "execution context" and mention a "ready-ticket preflight," but they lack specific directives for using prompt delimiters or safety instructions to prevent the agent from following malicious commands embedded in the ingested ticket text.
Capability inventory: The skill possesses significant operational capabilities, including writing and implementing code slices, performing verification checks, and potentially committing or pushing changes to version control (shipping) as described in SKILL.md and reference.md.
Sanitization: There is no explicit requirement or mention of sanitizing, escaping, or filtering the external content retrieved from tickets before it is interpolated into the agent's working context or used to drive the build loop.

task