The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes untrusted data from GitHub issues and project items to plan and execute tasks.
Ingestion points: The skill uses gh issue view and gh project item-list to fetch issue descriptions and comments as described in references/issue-selection.md and references/issue-reference.md.
Boundary markers: There are no instructions to use specific delimiters or to ignore potential instructions embedded within the issue content when the agent processes the descriptions.
Capability inventory: The agent has the ability to execute shell commands for git operations, create local directories (worktrees), and perform authenticated writes to GitHub (updating issues, descriptions, and PRs) using the gh CLI.
Sanitization: The instructions do not specify any sanitization or validation of external strings (such as issue slugs or titles) before they are interpolated into shell commands for worktree management or branch naming.
[SAFE]: The skill demonstrates security consciousness through the following mechanisms:
Secret Prevention: It enforces the use of gitleaks and prohibits bypassing it with --no-verify during the commit and push process as stated in SKILL.md.
Credential Safety: It provides instructions for managing tokens via .env files and explicitly forbids the agent from printing token values to output in references/issue-reference.md.
Human-in-the-loop: It requires explicit user approval before performing write operations to GitHub when in Plan mode, as described in SKILL.md.

kf-g-github-issue-worktree-management