The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill attempts to execute a shell script located at a path constructed dynamically from environment variables, which can lead to the execution of unintended files if the environment is compromised or misconfigured.
Evidence: The command "${CLAUDE_PLUGIN_ROOT:-${HOME}/.claude-octopus/plugin}/scripts/safe-gh-comment.sh" in SKILL.md uses variable expansion to determine the executable's location.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to interact with GitHub and project management tools, including piping AI-generated content to a script.
Evidence: printf '%s\n' "$TRIAGE_NOTE" | "${CLAUDE_PLUGIN_ROOT:-...}/safe-gh-comment.sh" --repo OWNER/REPO issue-comment ISSUE_NUMBER -
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from public GitHub repositories (issues and PRs) and reporter communications, which may contain malicious instructions designed to influence agent behavior during triage.
Ingestion points: The skill reads from gh issue list, gh pr list, and external reporter inputs to perform its workflow in SKILL.md.
Boundary markers: There are no explicit instructions or delimiters defined to isolate the untrusted issue content from the agent's logic.
Capability inventory: The agent has permissions to edit issues (gh issue edit), update tracking (bd update), and execute shell scripts to post comments.
Sanitization: The skill delegates safety to an external script (safe-gh-comment.sh), but the sanitization logic of this script is not part of the skill's own code and cannot be verified.

skill-intake