The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill is instructed to execute a Python script (scripts/render_review.py) located at a path (<skill root>) that is resolved at runtime from the record.paths.skill_root property within a record.json file. This dynamic path resolution for executable code introduces a risk where a compromised metadata file could redirect the agent to execute scripts from an arbitrary or malicious directory.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data to drive its primary logic and implementation tasks.
Ingestion points: The skill reads docs/agents/issue-tracker.md and processes user-supplied issues, tickets, and specifications from external sources.
Boundary markers: The instructions lack explicit delimiters or warnings to treat these external inputs as untrusted data, increasing the risk of the agent following instructions embedded within those issues.
Capability inventory: The skill possesses significant capabilities including file system writes (for code implementation), arbitrary shell command execution (via repository-specific verification checks), and network-facing operations (git push and pull request creation on external forges).
Sanitization: There is no mention of sanitization, validation, or filtering of the ingested issue data before it is used to influence the agent's implementation and publication actions.
[COMMAND_EXECUTION]: The skill executes shell commands to run "the repository's documented focused checks" and explicitly uses python3 to run internal review rendering scripts.

implement-publish