The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection because its primary function is to ingest instructions from external, potentially untrusted sources.
Ingestion points: The agent is instructed to read plan files (docs/plans/*.md) and fetch issue content using gh issue view <n> or via URL.
Capability inventory: The skill has access to powerful tools including Bash, Write, and Edit, allowing it to modify files and execute shell commands.
Boundary markers: The instructions lack explicit delimitation or warnings to prevent the agent from following malicious instructions that might be embedded within the issue description or plan files.
Sanitization: There is no evidence of sanitization or filtering of the external data before it influences the agent's behavior.
[COMMAND_EXECUTION]: The skill is designed to automatically discover and execute shell commands defined within the repository's metadata files.
Evidence: In the 'Run the done-gate' section, the agent is instructed to find commands in package.json, Makefile, pyproject.toml, justfile, and CI configurations and execute them to verify the build.
Risk: This behavior allows the execution of arbitrary commands. If the repository being worked on is malicious or has had its configuration files compromised, the agent will execute those malicious commands as part of its verification process.

implementkit