The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a wide range of shell commands for project management and environment setup. Evidence includes git worktree operations (git worktree add), database management (pgsql|mysql creations), and project-specific tooling (vendor/bin/pint). It also modifies local files via shell redirections, such as appending to scratch-databases inside the Git common directory.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes external data to drive its core logic.
Ingestion points: Reads specifications from .scratch/<slug>/spec.md and individual ticket files which determine the tasks for the subagents.
Boundary markers: The instructions use context pointers for subagents, but there are no explicit delimiters or 'ignore embedded instructions' warnings provided to isolate the agent's logic from potentially malicious content in the spec or tickets.
Capability inventory: The skill can spawn background subagents, execute shell commands, manage databases, and perform git operations (push/merge).
Sanitization: There is no mention of escaping or validating content from the spec or tickets before including it in subagent briefs.
[DYNAMIC_EXECUTION]: The skill dynamically spawns and manages multiple subagents (run_in_background: true, spawn_agent). These agents are provided with briefs constructed at runtime from the content of the ticket files and the main specification, which could lead to unauthorized code execution if the input files are compromised.

implement-spec