The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the GitHub CLI (gh) and Git. These commands (e.g., gh label create and git check-ignore) incorporate variables like <slug> and <feature>, which are derived directly from filenames in the workspace. Because these variables are not sanitized or escaped before being interpolated into shell commands, a maliciously named file (e.g., $(touch EXPLOIT).md) could result in arbitrary command execution when the skill is run.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local workspace (PRD files) and uses it to drive agent actions and command generation.
Ingestion points: The skill reads PRD filenames and content from docs/prds/ (SKILL.md Step 1).
Boundary markers: There are no explicit delimiters or instructions provided to the agent to prevent it from interpreting data within the PRD as instructions.
Capability inventory: The agent has the ability to execute shell commands via the gh and git CLIs, and to write markdown files to the docs/plans/ directory.
Sanitization: The skill lacks any logic to sanitize or validate the <slug> or <feature> strings before they are used in sensitive shell operations.

to-plan