The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill inherently processes untrusted data when performing tasks such as issue triage or pull request reviews, which creates a surface for indirect prompt injection.
Ingestion points: Data is ingested through issue backlogs and PR diffs as described in references/problem-solving.md and references/reviewing-changes.md.
Boundary markers: The workflow uses distinct artifacts—'Intent', 'Specification', and 'Plan'—to establish a baseline of user-accepted requirements that are kept separate from external input.
Capability inventory: The agent is authorized to execute shell commands for project verification (tests, linters) and to write durable records to the repository.
Sanitization: The skill mitigates risks through human-in-the-loop 'Governed' paths, requiring explicit user authorization for material changes and independent review of implementation evidence.
[COMMAND_EXECUTION]: The skill executes project-specific verification commands and scripts to validate behavior (references/delivery.md). This is a primary function of the tool and is performed within the project's existing configuration, with instructions explicitly forbidding unauthorized changes to project hooks or execution environments.
[SAFE]: The skill is designed with a strong security posture. It mandates a read-only approach for initial inspection, requires claims to be verified by observable facts, and uses 'Protected Gates' at external boundaries to prevent the bypass of security controls.

gap