The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted data from external issue trackers (GitHub/Jira), which represents an indirect prompt injection surface.
Ingestion points: The skill collects issue titles, bodies, and comments as described in references/issue-collection.md.
Boundary markers: While data is stored in localized files (issue.md), the skill lacks explicit delimiters or instructions to the agent to disregard natural language commands that might be embedded within the external issue data.
Capability inventory: The agent has significant capabilities, including filesystem writes, network requests via curl, and executing shell commands via git and gh.
Sanitization: The skill performs basic sanitization of metadata like Jira labels and verifies image signatures, but does not sanitize the natural language content for potential injection patterns.
[EXTERNAL_DOWNLOADS]: The skill downloads images from issue attachments to use as visual evidence.
Evidence: scripts/issue-media.mjs handles downloading images using curl.
Safety: It implements a host verification mechanism to ensure authentication headers are only sent to trusted domains (e.g., GitHub or Jira hosts). It also performs signature-based file type verification to ensure downloaded files are valid images before processing.
[COMMAND_EXECUTION]: The skill makes extensive use of local shell commands to perform repository operations.
Evidence: scripts/issue-common.mjs and scripts/issue-start.mjs use spawnSync to run git, gh, and curl.
Mitigations: Input parameters such as issue numbers are parsed for specific patterns, and descriptive strings are slugified to prevent shell injection vulnerabilities.

issue-start