The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill ingests untrusted data from GitHub issues and PRs (such as issue bodies and titles) which are then processed by various subagents during triage and fix phases. While this is necessary for the skill's intended purpose, it presents a potential surface where malicious instructions embedded in an issue could attempt to influence the agent's behavior.
Ingestion Points: Issue data enters via gh issue list and is passed to subagents in assets/triage-prompt.md and assets/fix-prompt.md.
Mitigation: The architecture employs 'Worktree isolation' to prevent cross-contamination, enforces 'ASCII-only' artifacts, and uses structured subagent prompts that explicitly limit capabilities (e.g., 'Do NOT modify the working tree' during triage).
Sanitization: The skill specifies that cell writes to the ground-truth table must be sanitized ASCII summaries.
[Command Execution via Developer Tools]: The skill utilizes standard command-line utilities such as git, gh (GitHub CLI), and uv (Python toolchain) to manage the bug queue and perform fixes. These tools are used within a structured 'plan + execute + verify' framework to ensure deterministic outcomes.
Evidence: SKILL.md and references/invariants.md document the usage of gh issue list, git worktree, and uv run ruff for repository management and code quality enforcement.
[External Resource Integration]: The skill interacts with the vendor's host repository and utilizes well-known Python packages for testing and linting. These operations are consistent with the skill's role as a developer-oriented orchestrator.
Evidence: References to github.com/microsoft/apm and the use of ruff and pytest are integrated into the workflow as documented in assets/fix-prompt.md and references/invariants.md.

batch-bug-shepherd