The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its integration with external task data.
Ingestion points: Untrusted content is fetched from GitHub issues using gh issue view and from the 'beads' task tracker using bd show.
Boundary markers: The instructions for spawning subagents (e.g., the Implementer) do not employ explicit delimiters or boundary markers to encapsulate the untrusted task content, increasing the risk that embedded instructions could override the subagent's role.
Capability inventory: The skill orchestrates multiple subagents with significant permissions, including file system access and the ability to interact with the repository and GitHub CLI.
Sanitization: There is no evidence of validation or sanitization of the fetched issue titles or descriptions before they are used as task inputs for other agents.
[COMMAND_EXECUTION]: The skill constructs and executes shell commands that include variables derived from potentially untrusted external inputs.
Evidence: Commands such as bd create "<description>" and bd create "<title>" -d ... interpolate strings sourced directly from GitHub issue data, which could lead to command injection if those inputs contain malicious shell sequences or special characters.

coordinator