The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes significant volumes of untrusted data from audited pull requests, issues, and comments.
Evidence: The workflow in SKILL.md involves fetching and analyzing titles, bodies, and discussion threads from the forge.
Mitigation: The skill includes explicit instructions for the agent to treat audited content strictly as evidence for judgment and never as directives, which is a key defense against accidental obedience to instructions embedded in reviewed data.
[COMMAND_EXECUTION]: The skill acquires authentication tokens by executing a shell command defined in a repository configuration file (docs/agents/issue-tracker.md).
Evidence: references/publishing.md specifies using sh -c to run a review-token command obtained from repository metadata.
Risk: If the agent is instructed to audit an untrusted repository that has modified this configuration file in a pull request, it could lead to arbitrary shell command execution in the agent's environment during the authentication phase.
[DYNAMIC_EXECUTION]: Local Python scripts execute shell commands, primarily git and other scripts, using the subprocess module.
Evidence: Observed in scripts/build_shared_block.py, scripts/forge_packet.py, and multiple test files.
Mitigation: The commands are generally constrained to data retrieval and validation tasks using commit SHAs and filenames established during the resolution phase of the audit.

audit-code-publish