The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses standard command-line utilities (git log, git blame, gh pr view) to establish a 'code anchor' by inspecting local and remote repository history. These operations are limited to read-only metadata retrieval and are appropriate for the skill's stated purpose.
[DATA_EXFILTRATION]: While the skill accesses potentially sensitive information from internal tools (Slack, Notion, Datadog, etc.) via Model Context Protocol (MCP) servers, this data is processed locally within the agent's context to generate an answer for the user. No unauthorized exfiltration to external or unknown domains was observed.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection due to its core function of ingesting data from untrusted or external sources.
Ingestion points: Data enters the context through gh pr view outputs and various MCP connectors for Linear, Notion, Slack, and Sentry (see SKILL.md Step 3).
Boundary markers: The skill employs 'Investigator' prompt templates (see references/investigator-prompt.md) that emphasize quoting verbatim and maintaining epistemic discipline, which provides a natural defensive barrier, though it lacks explicit technical delimiters to prevent the agent from following instructions embedded in the data.
Capability inventory: The agent has access to shell execution (bash), SQL execution via Databricks MCP, and various specialized tools for searching enterprise data.
Sanitization: No explicit sanitization or filtering of external content is performed before interpolation into the synthesizer's context.
[DYNAMIC_EXECUTION]: The skill describes a delegation model involving 'Codex CLI workers' or subagents, referencing a local script spawn-codex-worker (see SKILL.md). This is a mechanism for parallelizing investigative tasks within the host environment rather than a vector for malicious code generation or remote code execution.

why