The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external and potentially untrusted sources which could be used to influence agent behavior through indirect prompt injection. * Ingestion points: The agent reads Git commits, GitHub PR descriptions, GitHub issue threads, and conversation history. * Boundary markers: The instructions lack explicit delimiters or warnings to treat external content as untrusted. * Capability inventory: The agent possesses shell command execution via Taskwarrior, Git, and GitHub tools, as well as file writing and editing permissions. * Sanitization: While a leak-checking gate is mentioned, there is no evidence of sanitization for preventing instruction injection from external content.
[COMMAND_EXECUTION]: The skill performs automated shell command execution and script invocation. * Local script execution: The survey phase invokes a shell script located outside the immediate skill directory. * Autonomy overrides: Commands for Taskwarrior are configured to bypass standard user confirmation prompts. * Command construction: The agent constructs shell commands using strings derived from user conversation and PR descriptions, creating a potential command injection surface.
[PERSISTENCE_MECHANISMS]: The skill defines a session-end hook designed to trigger autonomously based on user behavioral patterns, referencing a nudge script for automated activation.

session-wrap