The Agent Skills Directory

[COMMAND_EXECUTION]: The skill defines shell commands for Git and GitHub operations that use placeholder interpolation (e.g., {short-name}, {N}, {body}). If the agent populates these placeholders using unsanitized data from untrusted sources, such as a malicious GitHub issue title or description, it could lead to command injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data to drive its state and operations, creating a vulnerability surface for indirect instructions.
Ingestion points: Data is ingested from GitHub issues (via gh issue commands) and the local state file .claude/epic.local.md.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when processing external issue or PR content.
Capability inventory: The skill has the ability to execute shell commands (Git and GitHub CLI), create/delete directories (worktrees), and write local state files.
Sanitization: While the skill provides logic for slug derivation (kebab-casing), it lacks comprehensive sanitization or validation for larger text blocks like issue bodies before they are used in commands or displayed to the user.

workflow-reference