The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from the repository and git history, creating a surface where malicious instructions in a codebase could influence the agent.
Ingestion points: The skill reads issue bodies, git logs, CI status rollup data (gh pr view --json statusCheckRollup), and repository documentation (README.md, CHANGELOG.md, CONTRIBUTING.md) as part of the start and finish workflows outlined in references/start.md and references/finish.md.
Boundary markers: No explicit delimiters or boundary markers are mentioned when interpolating ingested data into prompts for classification or spec generation.
Capability inventory: The skill possesses significant capabilities, including executing git commands (commit, push, merge, tag), writing to sensitive files (manifests, specs, changelogs), and making network requests via forge CLI tools (gh, glab, fj, tea).
Sanitization: There is no evidence of sanitization or filtering of data ingested from the repository context before it is used to drive agent decisions.
[EXTERNAL_DOWNLOADS]: The skill interacts with and recommends the installation of external forge CLI tools.
Evidence: references/finish.md (Step B1) instructs the agent to detect and potentially install forge CLIs like gh (GitHub), glab (GitLab), fj (Forgejo), and tea (Gitea). It suggests using Homebrew (brew install gh) for resolution. As these relate to well-known development services and official tooling, this is considered a safe implementation of required dependencies.
[COMMAND_EXECUTION]: The skill makes extensive use of local command execution to perform its primary function.
Evidence: references/finish.md and references/start.md contain numerous bash scripts for git operations, toolchain detection (e.g., bun test, pytest, cargo test), and data parsing using jq, sed, and awk. These commands are scoped to development tasks and include safety checks, such as using --ff-only for pulls and avoiding --force-push.

dev-cycle