The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external content which creates a surface for indirect prompt injection attacks.
Ingestion points: SKILL.md (Process Step 1) fetches and reads the full body and comments of issues, URLs, or file paths provided as arguments.
Boundary markers: Absent. The instructions do not specify the use of delimiters or instructions to ignore potential commands embedded within the fetched external data.
Capability inventory: The skill possesses the capability to write to the local filesystem (under .scratch/) and perform network writes to external issue trackers (GitHub, Linear, etc.) via platform-configured tools.
Sanitization: Absent. There is no mention of validating, escaping, or filtering the content retrieved from external sources before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch external artifacts when a URL is provided as a source argument.
Evidence: SKILL.md (Process Step 1) states: "If the user passes a reference (a spec path, an issue number or URL) as an argument, fetch it and read its full body and comments."
Context: This behavior is intended for retrieving specifications from well-known services like GitHub or Linear, but the fetch operation targets user-provided URLs.
[DATA_EXFILTRATION]: The skill reads codebase context and ADRs to inform ticket descriptions and then transmits this data to external trackers.
Evidence: SKILL.md (Step 2 and Step 5) involves exploring the codebase for domain vocabulary/ADRs and then publishing the resulting tickets to a "real issue tracker (GitHub, Linear, …)".
Context: This represents the primary intended function of the skill, and the destination is controlled by the user's repository configuration (/setup-repo-skills), which limits the risk of unauthorized exfiltration.

to-tickets