The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses the gh CLI to interact with GitHub Issues, project boards, and milestones. It also utilizes git for repository context and node/python for configuration parsing via the tracker_write and tracker-issue.js helpers.
[DATA_EXFILTRATION]: The skill reads from local project files, including .env, skills-config.yaml, and project.yml, to determine configuration and credentials. To mitigate risk, defer-mutation.js implements an environment-sweep redaction mechanism that identifies and replaces sensitive values (like tokens and passwords) with their variable names before any data is recorded in internal action logs or displayed to the user.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-defined markdown files (stories) and synchronizes their content to GitHub Issues. This presents an indirect prompt injection surface where malicious instructions in a story file could potentially target the gh CLI or subsequent readers of the GitHub Issue. The skill mitigates this by implementing content-capping logic (summarization) to limit the amount of content sent to the tracker.
[DYNAMIC_EXECUTION]: To ensure robust operation across different environments, the skill uses python -c for full YAML parsing and falls back to specialized awk scripts for a strict subset of YAML syntax. It also uses node -e for controlled JSON processing within shell scripts. These snippets are static and used for configuration resolution.

sync-github-story