The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from ticket bodies and comments, creating a potential surface for indirect prompt injection attacks where malicious content in a ticket could attempt to override agent instructions during triage.
Ingestion points: The agent reads ticket content and associated comments using tracker operations defined in external documentation at docs/agents/issue-tracker.md (SKILL.md, Step 1).
Boundary markers: The instructions do not specify the use of delimiters or specific warnings to ignore embedded instructions within ticket data when evaluating tiers or state transitions.
Capability inventory: The agent is empowered to edit tickets (SKILL.md, Step 1 & 3), write ticket metadata to local project files at .skills/<CODE>/tickets.md (SKILL.md, Step 1), and modify requirements documents (TESTS.md, 1.1.0).
Sanitization: No evidence of content sanitization was found; the skill is explicitly directed to quote approved text back into ticket comments, which could propagate malicious payloads (SKILL.md, Step 3).
[COMMAND_EXECUTION]: The skill relies on the execution of external binary tools and shell scripts to manage the issue tracker and simulate test scenarios.
Evidence: Instructions specify using "tracker ops" and interacting with a stateful bin/gh command-line utility for board management (SKILL.md, Step 1; TESTS.md, 1.1.0).
Evidence: The testing framework utilizes multiple shell scripts, including scenarios/gh-board.sh and scenarios/gh-roles.sh, to configure the agent's operating environment (TESTS.md, 1.0.0).

shape