The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple external sources that could contain malicious instructions.
Ingestion points: Reads README.md, ROADMAP.md, CLAUDE.md, CHANGELOG.md, LICENSE, package.json, pyproject.toml, and GitHub/Forgejo issue/PR data.
Boundary markers: None observed in the instructions when interpolating these files into the audit logic.
Capability inventory: The skill has high capabilities, including file writing (updating ROADMAP.md, .gitignore, NOTICE), network access via gh and fj CLIs, and shell command execution via Bash.
Sanitization: No explicit sanitization of roadmaps or issue titles is performed before they are processed or written back to files.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to execute complex shell pipelines for filesystem hygiene, branch management, and metadata extraction. While these are part of the intended functionality, they represent a significant attack surface if input files (like README.md tree blocks) are manipulated to include command injection characters.

health