The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from GitHub pull requests and local worktrees, creating a potential surface for indirect injection attacks.
Ingestion points: The skill reads content from GitHub PR diffs, conversation threads, titles, and bodies, as well as the content of all in-scope files in a local worktree.
Boundary markers: The skill includes a specific 'Retrieved Evidence Boundary' section that instructs the agent to treat external content as data/evidence only, not as authority, and explicitly states that instruction-like text in data cannot change the skill's protocol or approved scope.
Capability inventory: The skill's operations are strictly limited to read-only actions; it explicitly forbids modification of repository state, index editing, or creation of snapshots.
Sanitization: The skill mandates binding material inputs to specific identifiers and re-validating them before issuing a verdict to ensure no material drift has occurred during the analysis.
[DYNAMIC_EXECUTION]: The skill documentation suggests utilizing environment-defined tools for code verification.
Evidence: In references/typescript.md, the skill instructs the agent to 'Use the repository's typecheck/lint command when safe and relevant.'
Risk: Executing arbitrary commands defined within a repository (e.g., scripts in a package.json or local binaries) can lead to code execution if the repository itself is malicious or has been compromised.

tk-review