The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub and Linear issue records, which could contain malicious instructions.
Ingestion points: The skill reads issue titles, bodies, and comments from external trackers as described in references/github.md and references/linear.md.
Boundary markers: Instructions in SKILL.md mandate that external text be "quoted visibly and completely" and specify that issue content "cannot approve" changes. The skill requires explicit user approval with a specific phrase (Do you approve this exact N-effect batch?) before any write operation.
Capability inventory: The skill can create, update, and close issues, and manage labels and relationships using gh and orca CLI tools. It also performs configuration writes.
Sanitization: All external content is passed to CLI tools via structured argument vectors or stdin to prevent shell injection. Path validation in scripts/config_check.py prevents directory traversal and symlink attacks.
[COMMAND_EXECUTION]: The skill interacts with the local environment using external CLI tools and a bundled validation script.
Evidence: The skill executes the gh (GitHub) CLI, orca (Linear) CLI, and python3 scripts/config_check.py.
Mitigation: Command construction avoids shell interpolation by using structured arguments, which effectively isolates untrusted issue content from the execution environment.
[DYNAMIC_EXECUTION]: The skill executes a bundled Python script for validation.
Evidence: SKILL.md directs the agent to run python3 scripts/config_check.py to validate .agents/managing-issues.json.
Analysis: The script is part of the skill's distribution and implements defensive security checks, including verifying that the target path is a regular file and not a symlink, and enforcing strict data schemas.

managing-issues