The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by design as it ingests untrusted external data into the agent's reasoning context.
Ingestion points: The prompt templates in 'references/fanout-prompts.md' specifically use 'gh issue view' and 'gh pr diff' to fetch external content that is then provided to subagents.
Boundary markers: The templates use structured headers like 'Project context' and 'Deliverables', but they lack explicit 'ignore embedded instructions' warnings for the ingested external content.
Capability inventory: The orchestrated subagents have access to tools for shell command execution ('git', 'gh'), file system writes, and background process management ('nohup').
Sanitization: The skill does not define or perform sanitization, filtering, or validation on the content retrieved from external GitHub issues or pull requests before processing it.
[SAFE]: The skill implements resource management safeguards by establishing a hard cap of 40 agents per run (with a routine budget of 10-20), which prevents platform-level rate limiting and accidental cost spikes.
[SAFE]: Explicit security constraints are provided in the prompt templates (e.g., 'NEVER read or print .env or any secrets file') to mitigate the risk of accidental credential exfiltration by automated subagents.
[SAFE]: The skill utilizes git worktrees to ensure operational isolation for parallel tasks, which is a security best practice that prevents race conditions, unauthorized file access between tasks, and cross-agent data leakage.
[SAFE]: The skill uses a hierarchical model routing strategy, keeping high-level architectural decisions on stronger reasoning models ('Sol'/'Opus' tiers) while delegating bounded implementation tasks to lower tiers, ensuring adequate supervision of complex logic.

agent-fanout