The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file (Step E3) utilizes an unquoted shell heredoc (cat > .claude/state/issue-body.md <<EOF) to construct issue bodies. The skill documentation explicitly notes this as a residual risk: '<<EOF still performs command substitution, so a $(…) or a backticked span in the document's own text is executed while the body is being written.' This enables the execution of arbitrary shell commands if the source epic file's summary or description contains malicious shell syntax.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes content from external epic markdown files (EPIC_FILE_PATH). Because the extracted title and goal/summary sections are interpolated into the shell-evaluated heredoc mentioned above without sanitization, it creates an attack surface where instructions embedded in project data can trigger local system actions.
Ingestion points: EPIC_FILE_PATH is read and its frontmatter/prose sections are extracted (SKILL.md).
Boundary markers: The content is wrapped in a heredoc structure, but the unquoted EOF delimiter fails to prevent command substitution within that boundary.
Capability inventory: The skill can execute shell commands via gh, node, grep, and awk, and write to the local filesystem.
Sanitization: Content is passed through jq for structure, but the final prose is used raw in the heredoc interpolation.
[DYNAMIC_EXECUTION]: The helper script references/read-config.sh executes a multi-line Python program using python -c. While the script includes hardening measures to prevent local module shadowing by clearing empty or relative paths from sys.path, the use of runtime-evaluated code strings for configuration parsing is a form of dynamic execution.

ensure-epic-github-issue