The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill relies on reading and processing markdown files from the docs/chart/ directory to manage its state and determine next steps. This creates a surface for indirect prompt injection.
Ingestion points: The agent is instructed to read map.md and all files within tickets/ in SKILL.md.
Boundary markers: There are no instructions to use delimiters or to treat the content of these files as data rather than instructions.
Capability inventory: The skill allows the use of powerful tools including Bash, Agent (sub-agent creation), Write, and Edit as defined in the allowed-tools section of SKILL.md.
Sanitization: The skill lacks mechanisms to sanitize or validate the content of the tickets before the agent acts upon the "Question" or "Task" descriptions.
[COMMAND_EXECUTION]: The skill uses the Bash tool to automate "Task" type tickets, which are defined as manual work. If a ticket contains malicious commands, the agent is instructed to drive these tasks "AFK" (agent alone), potentially executing arbitrary shell commands without direct oversight.
[DYNAMIC_EXECUTION]: The skill invokes the Agent tool with subagent_type: "Explore" to resolve research tickets. This dynamic invocation delegates exploration to sub-agents that may ingest untrusted information from external documentation or APIs, further expanding the data ingestion attack surface.

chart