The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill processes finding data from external sources (scan-manifest.json and findings.json). If this data contains malicious instructions, it could potentially influence the agent's behavior during the creation of issues or advisories. The skill mitigates this by instructing the agent to treat every string as untrusted data and not as instructions, though the ingestion surface remains a point of review.
Ingestion points: Data is read from scan-manifest.json and findings.json located in a user-supplied directory.
Boundary markers: The skill explicitly instructs the agent to treat scan content as data, not instructions.
Capability inventory: The skill uses gh CLI, local Python scripts, and native apps (Linear, Atlassian) to write data externally.
Sanitization: Requires shell-quoting of all parameters and the use of mode-0600 temporary files for issue bodies to prevent shell injection or accidental exposure.
[Shell Command Execution]: The skill utilizes the gh CLI and a local Python script (validate_tracking_source.py) to perform operations. While these are necessary for the skill's functionality, they represent a command execution vector. The skill incorporates extensive safety requirements, such as avoiding eval, implementing strict shell-quoting, and verifying transport identities before execution.
[Authorized Data Transfer]: The primary purpose of this skill is to transfer security findings from a local scan to external platforms (GitHub, Jira, Linear). While this involves data leaving the local environment, the skill mandates explicit user approval for every write, clear warnings regarding destination visibility (private vs. public), and verification of the target audience.

track-findings