The Agent Skills Directory

[COMMAND_EXECUTION]: The 'Success check' section defines a bash script that executes the GitHub CLI using raw user input. Specifically, the line gh pr list --head <branch-name> interpolates the <branch-name> argument directly into a shell environment. If a user provides a branch name like ; touch malicious.txt #, the shell will execute the command following the semicolon.
[PROMPT_INJECTION]: The skill retrieves data from an external tool (mcp__plugin_dh_backlog__backlog_list) and uses the resulting 'issue' or 'plan' fields as arguments for another skill invocation (dh:complete-implementation). This creates an indirect prompt injection vulnerability if the content of the backlog item is controlled by an untrusted source.
Ingestion points: External backlog data retrieved via the mcp__plugin_dh_backlog__backlog_list tool in the 'Branch -> backlog lookup algorithm' section.
Boundary markers: None; the output from the backlog tool is used directly as a parameter for the next skill.
Capability inventory: Execution of shell commands via gh and triggering secondary skills like dh:complete-implementation.
Sanitization: No validation or escaping is performed on the retrieved target or the user-supplied branch_name before they are used in executable or instructional contexts.

gate-push