The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves reading and acting upon content retrieved from an external issue tracker, such as ticket bodies and resolution comments. This represents a significant attack surface where a malicious actor could embed instructions in an issue to influence the agent's behavior during 'grilling', 'research', or 'prototype' tasks. * Ingestion points: SKILL.md describes loading the map, tickets, and resolution comments from an issue tracker. * Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified for processing issue content. * Capability inventory: The skill calls tools for research, prototyping, and domain modeling, manages issues (create, close, comment), and can spawn subagents. * Sanitization: There are no mentions of sanitizing or validating the content retrieved from the tracker before it is used in prompts.
[CREDENTIALS_UNSAFE]: The skill instructs the agent to record 'credentials location' in issue resolution comments. Storing metadata about credentials or their locations in shared issue trackers is a poor security practice that can lead to credential exposure or facilitate lateral movement if the tracker is compromised or insufficiently restricted.

wayfinder