The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it processes untrusted data and passes it to a sub-agent.
Ingestion points: The skill fetches data from GitHub notifications, PR titles, PR comments, and Git commit messages (documented in references/source-adapters.md). This data originates from external contributors and is not inherently trusted.
Boundary markers: In SKILL.md (Step 4), untrusted data (LINEAR_DATA, CALENDAR_DATA) is interpolated directly into the prompt for the catchup-runner sub-agent without the use of explicit delimiters (e.g., XML tags or triple quotes) or 'ignore' instructions for the sub-agent.
Capability inventory: The sub-agent being targeted has the capability to execute gh and git commands and write files to the local directory (OUT_PATH), providing an automated path for any injected instructions.
Sanitization: There is no evidence of sanitization, escaping, or filtering of the fetched text before it is presented to the sub-agent.
[COMMAND_EXECUTION]: The skill relies on extensive shell command execution via the Bash tool.
Evidence: Files references/source-adapters.md and references/time-window.md contain complex shell pipelines, command substitutions, and loops. While these are used for legitimate data retrieval (e.g., git log, gh api), the complexity of the shell logic increases the risk of command injection if arguments like --since or user-controlled directory names are improperly handled during execution.

catchup