The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses the gh (GitHub) CLI to create, edit, and manage issues and project board fields. It also executes local Node.js scripts (e.g., doc-link-branch.js, tracker-issue.js) to handle logic such as branch resolution and mutation journaling.
[DYNAMIC_EXECUTION]: The read-config.sh script attempts to use python3 or python with pyyaml to parse configuration files, falling back to an awk-based parser if Python is unavailable. Additionally, tracker-issue.js uses node -e for small utility tasks like JSON stringification of arguments. These are used for internal configuration management and are not exposed to untrusted external input.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from local markdown task files (docs/tasks/...) to populate GitHub issue bodies. While this represents an ingestion of untrusted data, the skill mitigates risks by using strict templates (defined in tracker-card-summary.md) and a dedicated sanitization script (github-body-text.js) to handle problematic characters before they are sent to the GitHub API.
[DATA_EXPOSURE]: The skill accesses environment variables such as BITBUCKET_ACCESS_TOKEN, JIRA_API_TOKEN, and GITHUB_TOKEN (via the gh CLI) to authenticate with external services. These credentials are used solely for their intended purpose of interacting with official APIs (GitHub, Bitbucket, Jira). The skill includes a robust redaction engine in defer-mutation.js to ensure these secrets do not leak into journals or command-line outputs.

sync-github-task