The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes epic and story documents from the repository to identify conflicts and compliance issues.
Ingestion points: The epic document (DOC_FILE) and related story files are loaded in Step 1 of the workflow.
Boundary markers: The skill does not describe the use of specific delimiters or instructions to ignore instructions embedded in the analyzed documents.
Capability inventory: The skill is capable of creating review reports, updating document frontmatter, and synchronizing data to external trackers like Jira.
Sanitization: Content from the repository documents is cited in the review output but is not explicitly sanitized before processing.
[COMMAND_EXECUTION]: The skill executes multiple local scripts and system utilities to perform its auditing tasks.
Evidence: It uses node to run internal tools like doc-id.js and defer-mutation.js, and bash to execute platform scripts like resolve-platform.sh.
Evidence: It uses system binaries such as find, grep, jq, and git for repository analysis and branch management.
Context: These executions are scoped to local repository management and are consistent with the skill's auditing purpose.
[EXTERNAL_DOWNLOADS]: The skill manages interactions with external tracker and VCS platforms using established credentials.
Evidence: references/bitbucket-auth.sh resolves Bitbucket credentials from the environment variables BITBUCKET_ACCESS_TOKEN and BITBUCKET_API_TOKEN.
Evidence: The skill synchronizes content to Jira using the sync-jira-epic.js script, which relies on JIRA_API_TOKEN and JIRA_USER_EMAIL from the environment.
Context: These resources are used for standard project management synchronization and follow the platform's security protocols.
[DYNAMIC_EXECUTION]: The skill utilizes dynamic execution for configuration parsing and log management.
Evidence: references/read-config.sh executes a Python script via python -c to parse YAML configuration safely, employing a strict loader to prevent duplicate-key vulnerabilities and hardening the sys.path environment.
Evidence: Step 11 in SKILL.md uses node -e to execute a small shim that calls the change-log.js library for updating document history.
Context: These are utility functions for platform configuration and document maintenance, not for executing untrusted data.

review-epic