The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads and acts upon instructions provided in plan files (located in plans/) and feedback from pull request review comments. This creates a surface where an attacker could potentially influence the agent's behavior by embedding malicious instructions in these data sources.
Ingestion points: Plan files (plans/*.md) and pull request review comments retrieved from a remote repository.
Capability inventory: The skill can spawn subagents, execute shell commands (git, gh, jq), and perform file system operations (creating worktrees, committing code).
Boundary markers: The instructions specify briefing workers with specific scope rules, which acts as a partial boundary, though it does not fully sanitize external content.
Sanitization: No explicit data sanitization or escaping of the ingested plan content is mentioned before it is used to brief subagents.
[COMMAND_EXECUTION]: The skill utilizes shell commands for repository management and data processing.
Evidence: Commands such as git worktree add, git branch, gh pr, and jq are used to manage the development lifecycle and extract data from session logs.
[DYNAMIC_EXECUTION]: The skill dynamically manages the lifecycle of worker and reviewer subagents to perform its primary tasks.
Evidence: On the Pi platform, it utilizes the @lwlee2608/pi-subagent tool to start, message, and recover subagents with specific task briefs and configurations.

build-feature