The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands that incorporate user-supplied data, creating a risk of command injection.
The sync_to_github step uses the command gh issue create --title "$TITLE". If the issue title extracted from the conversation contains shell metacharacters (e.g., backticks, semicolons) and the agent does not properly escape the variable, it could lead to arbitrary command execution.
The check_duplicates step uses grep -l -i "[key words from title]". If the keywords derived from the user's input are not correctly handled, they could be used to manipulate the grep command or break out of the command string.
The git_commit step interpolates the issue title directly into a commit message via a heredoc, which is generally safer but still relies on the agent's ability to handle potentially malicious title strings.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the conversation history and processes it into structured files and external service calls.
Ingestion points: The extract_content step in SKILL.md analyzes recent conversation history to extract titles, problem descriptions, and technical details.
Boundary markers: Absent. There are no instructions for the agent to use delimiters or ignore instructions embedded within the conversation data being processed.
Capability inventory: The skill has the capability to write files to the local .planning/ directory, perform git operations, and create issues on GitHub via the gh CLI.
Sanitization: While the skill mandates a slug generation process for filenames (lowercase, hyphens, no special characters), it lacks explicit sanitization or validation for the content being sent to the GitHub API or used in shell search commands.

kata-add-issue