The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The ensure-bin.sh script downloads a compiled binary from the author's GitHub repository (morphet81/scrutiny).
[REMOTE_CODE_EXECUTION]: The skill executes the downloaded scrutiny binary to manage its automated development workflows.
[COMMAND_EXECUTION]: The skill executes various shell commands for testing, linting, and building code as part of its verification gate, and allows for arbitrary user-configured verify commands.
[DATA_EXFILTRATION]: The skill accesses sensitive environment variables (ATLASSIAN_EMAIL, ATLASSIAN_TOKEN) to interact with Jira APIs. While used for its primary purpose, this involves handling sensitive credentials.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by ingesting untrusted data from external issue trackers.
Ingestion points: Remote ticket content is fetched from Jira, GitHub, and GitLab issue URLs into the agent context (SKILL.md).
Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potentially malicious instructions embedded in the ticket descriptions.
Capability inventory: The skill has broad capabilities including file system modification, command execution via test runners and build tools, and the ability to spawn multiple sub-agents (SKILL.md).
Sanitization: The skill does not describe any sanitization or validation of the external ticket content before it influences the implementation agent's plan.

forge