The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill relies on reading and processing content from an external issue tracker (referenced as the repo's issue tracker) to guide agent behavior, which acts as an untrusted ingestion point for potentially malicious instructions.
Ingestion points: The agent is instructed to load the "map" (a canonical issue) and fetch the full body of "child issues" (tickets) from the tracker to determine its next actions (SKILL.md).
Boundary markers: The instructions do not specify any delimiters (such as markdown blocks or explicit ignore-tags) to help the agent distinguish between its own system instructions and the content retrieved from the issues.
Capability inventory: The skill has the capability to create and wire new issues, close issues, create git branches (research/<name>), and invoke a "Skill tool" with various modes including "research" (which explores resources outside the current directory) and "prototype" (which generates code artifacts).
Sanitization: There is no mention of validating, filtering, or escaping the content retrieved from the tracker before it is used to drive the agent's resolution logic or decision-making process.

wayfinder