The Agent Skills Directory

[PROMPT_INJECTION]: The skill incorporates a robust security framework via 'references/untrusted-content-rule.md', which provides explicit instructions to the agent to treat data from external sources (such as GitHub issues or Jira comments) strictly as data and never as instructions. This defensive posture is referenced at every ingestion point to prevent override attempts.
[DATA_EXFILTRATION]: All interactions with external trackers are handled through secure, gated helpers (e.g., 'references/tracker-comment.js', 'references/resolve-platform.sh'). These scripts implement the 'ACCESS_TRACKER' protocol, which limits the agent's ability to perform mutations based on user-defined security tiers. Furthermore, these scripts include automatic redaction logic that identifies and masks credentials (tokens, passwords) in any deferred action records or logs.
[COMMAND_EXECUTION]: The skill executes a suite of local, bundled JavaScript and shell scripts to perform complex analysis tasks like checking link validity ('references/doc-links.js'), managing change logs ('references/change-log.js'), and mapping wireframe components ('references/wireframe-map.js'). These executions are restricted to the local environment and are necessary for the skill's primary function.
[INDIRECT_PROMPT_INJECTION]: The skill identifies the ingestion of untrusted issue bodies as a potential attack surface and implements specific path-bounding logic in 'SKILL.md' (Step 3 of Input Resolution) to prevent path traversal attacks when resolving issue URLs to local files. It ensures all derived paths remain within the 'docs/' or project root directories.
[DYNAMIC_EXECUTION]: While some scripts (e.g., 'references/resolve-platform.sh') utilize 'eval' for variable expansion, the input variables are strictly constrained to whitelisted identifiers ('tracker', 'vcs') or well-defined environment variable names, mitigating the risk of command injection.

review-story