The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) by processing untrusted data from external sources. * Ingestion points: The skill fetches issue content (title, body, and comments) using gh issue view --comments in SKILL.md. This data is then interpolated into the {{ISSUE}} variable. * Boundary markers: There are no boundary markers, delimiters, or explicit instructions to ignore embedded commands when the {{ISSUE}} content is passed to the subagent prompts in prompts/coder.md and prompts/reviewer.md. * Capability inventory: The subagents have extensive capabilities, including executing shell commands via pnpm test and pnpm typecheck, and performing repository operations with git and gh (documented in prompts/coder.md and prompts/reviewer.md). * Sanitization: No evidence of sanitization, escaping, or validation of the ingested GitHub content was found.
[COMMAND_EXECUTION]: The skill is designed to run in an 'inline' mode, explicitly bypassing the Docker isolation typically used in sandcastle workflows. It executes shell commands like pnpm test and git commit directly in the agent's current working environment. This architectural choice increases the security risk associated with the identified indirect prompt injection surface, as malicious code introduced via an issue comment could be executed during the test phase with the same permissions as the agent.

inline-sandcastle