The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically generates a Workflow script using the WORKFLOW.md template and ticket-specific data, then executes it to perform implementation and verification tasks. It also extracts and runs a "verify command" and "clean-install command" defined in the repository's CLAUDE.md or CI configuration, which constitutes execution of code defined in the target environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub issue bodies, titles, and labels to parameterize its workflow and agent prompts. This introduces a vulnerability to indirect prompt injection where an attacker-controlled ticket could influence the agent's behavior during implementation or verification phases.
Ingestion points: Ticket metadata and content (body, title, labels) are fetched via gh issue view in SKILL.md (Arm and Tick sequences).
Boundary markers: The skill does not define or use explicit delimiters or "ignore instructions" warnings for the interpolated ticket content.
Capability inventory: The skill (across SKILL.md and WORKFLOW.md) utilizes shell command execution (git, gh, local toolchain), file system modification (git worktree), and network access (pushing/pulling to GitHub).
Sanitization: No sanitization or validation of the input data from GitHub issues is performed before use in downstream tasks.
[COMMAND_EXECUTION]: The skill relies on extensive execution of shell commands through the GitHub CLI (gh) and Git. The use of string interpolation for command arguments (e.g., in stack tip derivation and assignee checks in SKILL.md) presents a potential surface for command injection if API responses contain unexpected malicious characters.

implement-all