The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external data from GitHub issue bodies, user prompts, and file references to derive its implementation tasks. This ingestion of external content presents an indirect prompt injection surface where malicious instructions could be embedded in the data to override intended behavior.
Ingestion points: SKILL.md (Step 3: Resolve and read the input), specifically fetching GitHub issue content and reading raw user prompts.
Boundary markers: The instructions do not specify the use of clear boundary markers or delimiters to isolate untrusted input from the agent's core instructions.
Capability inventory: The skill has the capability to modify files (SKILL.md Step 6a), perform Git commits (SKILL.md Step 6c), and invoke internal tools like /update-implementation-report and /append-roadmap-feedback.
Sanitization: No explicit sanitization, escaping, or filtering of the ingested external content is mentioned before it is used to derive and execute tasks.
[COMMAND_EXECUTION]: To verify implementation tasks, the skill is instructed to run project-specific 'standing gates' such as linting, formatting, and type-checking scripts (e.g., check, lint, or typecheck scripts). This involves executing code defined within the project's repository, which is a necessary function of the skill but carries the risk of executing untrusted project scripts if the repository itself is compromised.
[EXTERNAL_DOWNLOADS]: The skill fetches data from external GitHub issue URLs to use as implementation instructions. As GitHub is a well-known and reputable service, this operation is documented as a functional requirement of the tool.

implement