The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from external sources (GitHub/GitLab issues or local Markdown files) to determine the agent's next actions. This data is untrusted and could contain malicious instructions.
Ingestion points: Data is read from the 'map' issue and individual 'tickets' (child issues) as described in SKILL.md.
Boundary markers: The instructions do not define delimiters or specific constraints to prevent the agent from executing instructions embedded within the ticket content.
Capability inventory: The agent can write to trackers, perform git operations (branch, push), and invoke sub-agents via the Skill tool.
Sanitization: There is no specified sanitization or validation of the content retrieved from the issue tracker before it is processed by the agent.
[DATA_EXFILTRATION]: The instructions for 'Task' tickets specify that the resolution should record 'resulting facts (credentials location, new URLs, row counts)'. Documenting the locations of credentials or other sensitive assets in persistent, potentially shared trackers increases the risk of discovery.
[COMMAND_EXECUTION]: The skill instructs the agent to execute various shell-level operations, including the use of an external utility setup-mvskills and several git commands (claiming tickets via labels/status, creating research branches, and pushing to remotes).

wayfinder