The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes shell scripts (scripts/spec-list.sh and scripts/spec-show.sh) that execute the GitHub CLI (gh) and jq. These scripts are used for status reporting and utilize standard shell safety measures. The commands are scoped to repository information retrieval and do not perform arbitrary execution.
[DATA_EXFILTRATION]: The skill accesses local git configuration (git remote -v) and GitHub issue metadata via official MCP tools. This access is necessary to provide the required context for drafting feature specifications and is restricted to the repository where the skill is active.
[PROMPT_INJECTION]: The skill processes data from GitHub issues (titles, bodies, and comments) to inform the specification process. While this represents a potential surface for indirect prompt injection from third-party content, the risk is inherent to the tool's core functionality of synchronizing implementation with project context.
Ingestion points: Issue data retrieved through mcp__github__issue_read and search tools in SKILL.md.
Boundary markers: Not explicitly defined in the prompt instructions for isolating external issue content.
Capability inventory: The skill allows writing to the filesystem and creating new GitHub issues via MCP tools.
Sanitization: The instructions do not specify explicit sanitization or filtering logic for content retrieved from existing issues.
[EXTERNAL_DOWNLOADS]: The documentation references external skills and methodologies located in the onsager-ai/dev-skills repository. As these are resources provided by the skill's author, they represent the intended ecosystem for the vendor's development process.

issue-spec