The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its ingestion of untrusted data from external sources.
Ingestion points: Retrieves content from ClickUp, Slack, Linear, and GitHub URLs, as well as pasted meeting transcripts or discussion buffers (SKILL.md Step 1).
Boundary markers: The instructions do not define clear boundaries or 'ignore' directives to prevent the agent from following instructions embedded within the ingested thread content.
Capability inventory: The skill has access to the Bash tool for data fetching and the Agent tool for spawning downstream workers via ao spawn (SKILL.md Step 6).
Sanitization: There is no evidence of content validation or sanitization of the discussion data before it is incorporated into the technical specifications and verification protocols.
[COMMAND_EXECUTION]: The skill uses the Bash tool to run a local Python script for ClickUp retrieval and the GitHub CLI (gh) for accessing issue metadata. It also generates an ao spawn command intended to initiate autonomous agent tasks.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to well-known service APIs, including ClickUp, GitHub, and Linear, to retrieve discussion data required for generating product specifications.

pm-thread-to-spec