The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources, specifically GitHub issues and pull requests, using commands like gh issue view and gh pr view to fetch conversations, bodies, and comments. This creates an attack surface for indirect prompt injection, where malicious instructions could be embedded in external content to manipulate the agent's actions during code implementation or PR reviews.
Ingestion Points: Data enters the agent's context through gh CLI commands in references/github-workflow.md and SKILL.md.
Boundary Markers: The skill does not explicitly define character-based delimiters for untrusted input, though it separates review and implementation tasks into dedicated worktrees.
Capability Inventory: The agent has the capability to write files, create commits, push to remote branches, and interact with Atlassian APIs (Jira/Confluence).
Sanitization: No specific content sanitization or escaping mechanisms for the fetched issue/PR text are defined in the provided files.
[COMMAND_EXECUTION]: The skill instructions involve significant use of system commands, including git for repository management and gh for GitHub API interactions.
Evidence: references/github-workflow.md contains numerous examples of command execution, such as git push, gh issue edit, and gh api calls.
Mitigation: The skill includes a robust permission model for sensitive actions, instructing the agent to treat commits, pushes, and PR creation as actions requiring explicit human approval or orchestrator coordination.

dev-platform-workflow