The Agent Skills Directory

[SAFE]: The skill performs its primary function of project task decomposition using standard development tools and practices. No malicious code, obfuscation, or unauthorized access patterns were detected.
[INDIRECT_PROMPT_INJECTION]: The skill demonstrates a surface for indirect prompt injection because it ingests data from external sources such as specification files and issue tracker URLs. However, this is necessary for its primary purpose and is mitigated by design.
Ingestion points: The agent reads conversation context, local file paths for specs, and URLs for issue tracker content (as described in SKILL.md).
Boundary markers: While explicit delimiters are not defined in the instructions, the workflow requires generating a draft for user review.
Capability inventory: The skill has the capability to write local markdown files to a designated work directory and to publish issues to external services like GitHub or Linear (as described in SKILL.md).
Sanitization: No explicit input sanitization is mentioned, but the risk is managed by a mandatory user-approval step ('Quiz the user') before any files are written or issues are published.
[DYNAMIC_CONTEXT_INJECTION]: The skill frontmatter includes 'disable-model-invocation: true', which is a security hardening measure that restricts the agent's execution environment while the skill is active.

to-tickets