The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates an automation that processes external, untrusted data to generate summaries.
Ingestion points: Slack messages from incident channels and follow-up tickets/comments from Linear are ingested into the agent's context in SKILL.md.
Boundary markers: The prompt construction phase (Step 3) lacks instructions for using delimiters or warning the agent to ignore instructions embedded within the Slack or Linear content.
Capability inventory: The skill uses MCP tools for Slack, Linear, and Notion, and executes curl commands to the platform's automation API.
Sanitization: There are no explicit instructions to sanitize or escape data retrieved from external sources before including it in the automation prompt.
[COMMAND_EXECUTION]: The skill uses curl to register automation presets with the platform backend.
Evidence: SKILL.md Step 4 instructs the agent to run curl -s -X POST "${OPENHANDS_HOST}/api/automation/v1/preset/prompt" using platform environment variables. While this is a standard integration pattern, the inclusion of a <constructed retro prompt> within the JSON payload (-d) presents a command injection risk if the agent does not properly escape single quotes or shell-active characters during execution.

incident-retrospective