The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub issues and pull request comments which could contain malicious instructions for the subagents.
Ingestion points: The fetch-issues tool is used in Stage 1 to retrieve issue bodies, and Stage 7 uses the gh api to fetch pull request comments.
Boundary markers: The skill uses specific HTML comments like  for state tracking, but it does not provide strong delimiters or "ignore" instructions for the raw issue content passed to the planner in assets/planner-brief.md.
Capability inventory: The agent has the ability to write to the file system, execute shell commands (git, gh, tests), and push code to remote repositories.
Sanitization: No sanitization or escaping of external issue content or user comments is performed before the data is interpolated into the agent briefs.
[COMMAND_EXECUTION]: The skill executes arbitrary shell commands based on configuration files found within the project being worked on.
Evidence: In Stage 5, the instructions require the agent to "run the project's test, lint, and typecheck commands (from AGENTS.md or the project's manifest)".
Context: If an attacker can influence the project's manifest or AGENTS.md file, they could achieve remote code execution when the build-lead agent verifies the work.
[DYNAMIC_EXECUTION]: The skill uses an external CLI tool to execute logic and generate structured data.
Evidence: Stage 7 describes using the codex CLI with the exec command to process pull request context and generate a JSON review block.
Context: While the skill uses a -s read-only flag for this operation, it still represents the dynamic execution of prompts/commands through an external interface.

implement-issues