The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources that could contain malicious instructions designed to influence the agent's actions.
Ingestion points: In SKILL.md, the agent is instructed to read content from Linear tickets via MCP and review findings from GitHub PR comments.
Boundary markers: The skill implements a selective trust policy by explicitly instructing the agent to only listen to the 'Codex' bot and ignore other automated review tools.
Capability inventory: The skill possesses significant capabilities, including modifying the codebase, executing shell commands for testing/linting, and driving the user's signed-in browser session.
Sanitization: There are no specific instructions for sanitizing or escaping the content retrieved from tickets or PR comments before processing.
[COMMAND_EXECUTION]: The skill executes various CLI tools including git, gh (GitHub), and gt (Graphite), and runs local test suites and linters. These commands are executed as part of the core shipping workflow but represent a vector if input data is compromised.
[DATA_EXFILTRATION]: The skill instructs the agent to access the user's authenticated browser session to capture screenshots of the application. While intended for documenting changes, this capability allows the agent to access potentially sensitive data within the user's browser context.

ship-interactive