The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use standard version control and repository management tools including git, gh (GitHub CLI), and glab (GitLab CLI).
Commands such as git pull --rebase, git push, gh pr view, and glab mr view are used to verify merge status and sync state.
These operations are essential for the workflow's goal of maintaining a synchronized source of truth in the spec vault.
[PROMPT_INJECTION]: The skill processes untrusted external data from pull request comments, creating an attack surface for indirect prompt injection.
Ingestion points: Review feedback is fetched from external repositories using gh pr view --comments or glab mr note list in the references/loop-integration.md file.
Boundary markers: The workflow does not specify the use of delimiters (e.g., XML tags) or explicit instructions to the agent to ignore potentially malicious embedded content within the comments.
Capability inventory: The agent possesses capabilities to modify documentation artifacts in the vault, perform git commits, and synchronize data with Postman collections.
Sanitization: There are no explicit steps provided to sanitize or validate the content of the external comments before they are triaged and acted upon by the agent.

spec-driven