The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting and processing data from untrusted external sources at runtime.
Ingestion points: The agent is instructed to read issue states, labels, latest comments, and pull request data to observe progress (found in references/launches.md). It also processes Markdown messages left by other sessions in the incoming/ directory (found in references/templates.md).
Boundary markers: There are no instructions in the skill files for the agent to use delimiters or specific safety markers to distinguish its own logic from the untrusted content it reads from external sources.
Capability inventory: The skill has significant capabilities, including the ability to write to files, perform git commits and pushes, execute shell commands through the wait.mjs script, and delegate tasks to sub-agents like implement or triage.
Sanitization: The instruction set lacks any requirements for sanitizing or validating external content before it is interpolated into the agent's plan logs or decision-making context.
[COMMAND_EXECUTION]: The skill executes a local Node.js script to perform system-level tasks and monitor external resources.
Evidence: The skill documentation in references/launches.md explicitly instructs the agent to run the local wait.mjs script: node <this skill's directory>/wait.mjs --interval <seconds> --max-duration <seconds> <item>....
Behavior: The wait.mjs script uses the node:child_process.execFile module to invoke git commands for checking repository state, fetching updates from remotes, and monitoring filesystem changes.

orchestrate