The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external project management trackers and passes it to sub-agents, creating an attack surface where malicious ticket content could influence agent behavior.
Ingestion points: The skill reads issue titles, bodies, and acceptance criteria from GitHub, Jira, or Markdown checklists via the read tracker operation.
Boundary markers: The instructions for the plan-agent and issue-agent interpolate ticket data (e.g., {body and acceptance criteria}) without explicit delimiters or instructions to ignore embedded commands.
Capability inventory: Sub-agents have access to powerful tools including Bash, Write, and repository mutation capabilities (git push).
Sanitization: No explicit sanitization or validation logic is defined for the content fetched from external trackers.
[DYNAMIC_EXECUTION]: The skill dynamically generates shell commands using data derived from external tracker references and issue identifiers.
Evidence: The 'tracker binding' system resolves references into command templates (e.g., gh issue edit {id} --add-label in-progress).
Evidence: Git operations, such as git branch "epic/$SLUG", use a slug derived from the user-provided epic reference. If the reference or ID is maliciously crafted and not properly escaped, it could lead to command injection within the local shell environment.

epic-runner