The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local CLI tools including git (blame, log, show), gh (pr view), and rg (ripgrep) to extract historical data from the repository. These tools are used with parameters extracted from the codebase (commit hashes, line ranges, PR numbers).
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection as it aggregates data from various external, user-controlled sources to answer 'why' a piece of code exists.
Ingestion points: Data is pulled from GitHub PR comments and bodies (SKILL.md), Slack threads (references/sources/slack.md), Linear tickets (references/sources/linear.md), and Notion documents (references/sources/notion.md).
Boundary markers: The prompt templates (references/investigator-prompt.md and references/synthesizer-prompt.md) lack explicit boundary markers or 'ignore embedded instructions' directives for the gathered content.
Capability inventory: The skill can spawn subagents (subagent spawn), execute shell commands (git, gh, rg), and call various MCP tools (e.g., execute_sql_read_only in Databricks).
Sanitization: The skill relies on 'Epistemic Discipline' (logic-based reasoning) rather than technical sanitization or escaping of the ingested text.
[DYNAMIC_EXECUTION]: The skill dynamically constructs instructions for subagents by interpolating external content (commit messages, PR descriptions, and tool outputs) into prompt templates (investigator-prompt.md and synthesizer-prompt.md).
[DATA_EXPOSURE]: The skill reads from ~/.config/pstack/pstack-models.md to determine the execution environment and models for its subagent workers, accessing potentially sensitive local configuration.

why