The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a shell script template in the 'State' section that iterates over a list of repositories (for r in <each repo this session touched>; do ... done). If the agent populates this list with paths containing shell metacharacters (e.g., through a maliciously named directory), it could lead to command injection when the script is executed by the agent's shell tool.
[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and reconcile data from external sources including GitHub issues, Linear issues, and local repository contents. These sources represent an ingestion surface where third-party content could contain malicious instructions intended to manipulate the agent's behavior during the wrap-up process.
Ingestion points: GitHub issue bodies/comments, Linear issue details, and git repository state (SKILL.md, Steps 2 and 3).
Boundary markers: None are defined to separate external data from the agent's internal instructions.
Capability inventory: The skill has capabilities to write to a 'Second Brain' vault, update remote trackers via APIs, execute git commands (push/pull/worktree), and terminate local processes (SKILL.md, Steps 1-6).
Sanitization: No explicit sanitization or validation of the external content is performed before the agent acts upon it or summarizes it into reports.
[SAFE]: The skill includes explicit security best practices, such as Step 7 ('Verify'), which requires the agent to check that no sensitive information (passwords, API keys, document images) is pushed to GitHub, Linear, or the vault.
[SAFE]: The skill implements a safety gate in Step 6, warning the agent to stop before using destructive commands like git worktree remove --force or rm -rf if the standard cleanup fails, which helps prevent accidental data loss.

session-wrap-up