The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow defined in SKILL.md (Step 4a) directly executes the claude command-line interface to spawn sub-agent sessions.
[DYNAMIC_EXECUTION]: The skill constructs and executes shell commands at runtime by interpolating external GitHub issue titles into the command string: claude ... 'Load /dh:groom-backlog-item {title}'. This allows untrusted data to influence the execution parameters of the sub-agent.
[PRIVILEGE_ESCALATION]: The parallel sub-agent sessions are invoked using the --permission-mode auto flag. This configuration allows the sub-agents to execute tools and system operations without human oversight or confirmation, bypassing standard security prompts.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by ingesting untrusted data from GitHub and passing it to high-capability sub-agents.
Ingestion points: Untrusted content is read from GitHub issue titles and descriptions via backlog_list_issues and backlog_view in SKILL.md.
Boundary markers: No boundary markers or protective delimiters are used when interpolating the {title} into the sub-agent's starting instructions.
Capability inventory: The skill spawns processes with automatic tool-use permissions and generates dispatch plans that control future code execution.
Sanitization: There is no evidence of sanitization or validation of issue titles before they are executed in the sub-agent context.
[COMMAND_EXECUTION]: The references/dispatch-plan-schema.md defines a quality_gates schema intended to store and execute arbitrary shell commands (e.g., uv run prek run --all-files). This creates a mechanism where the skill's output persists shell instructions that will be executed by downstream processes.

groom-milestone