The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies extensively on shell commands for project investigation. It uses git for status and history, gh (GitHub CLI) for PR and CI management, and system utilities like grep, ls, and log show to gather diagnostic information.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection.
Ingestion points: The skill reads content from untrusted external sources including TODOS.md, CHANGELOG.md, ROADMAP.md, and failing CI logs via gh run view --log-failed (as described in Phase 1-C and 1-E).
Boundary markers: The instructions lack explicit delimiters or "ignore embedded instructions" warnings for the agent when processing these external files.
Capability inventory: The agent has the ability to edit code, push to git repositories, and merge pull requests (gh pr merge).
Sanitization: There is no evidence of sanitization or filtering of the content ingested from the project files or CI logs before they are processed by the agent.
[DATA_EXFILTRATION]: The skill accesses potentially sensitive system data, including crash reports in ~/Library/Logs/DiagnosticReports/ and system logs via log show. While these are used for the intended purpose of app auditing, they represent the exposure of sensitive system state to the agent context.

wjs-auditing-project