The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from issue trackers, creating a surface for indirect prompt injection attacks.\n
Ingestion points: External ticket data including titles, bodies, and acceptance criteria are fetched from GitHub, Jira, or markdown checklists (as described in SKILL.md and the references/ directory).\n
Boundary markers: Prompt templates for sub-agents, such as the plan-agent and issue-agent in SKILL.md, interpolate this external data directly without using secure delimiters or instructions to ignore embedded malicious commands.\n
Capability inventory: Sub-agents, particularly the issue-agent defined in SKILL.md, are granted access to high-privilege tools including Bash, Write, Agent, and Skill, enabling them to execute system commands and modify the repository.\n
Sanitization: There is no evidence of sanitization or validation of the ingested ticket content before it is passed to the LLM-driven sub-agents.\n- [COMMAND_EXECUTION]: The orchestrator and its sub-agents extensively use the Bash tool (specified in the allowed-tools of SKILL.md) to perform repository management, git operations, and interaction with command-line interfaces for tracking services like GitHub (gh) and Jira (jira).

epic-runner