The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands for repository state tracking and task verification. Evidence includes:
Use of git branch --show-current and git rev-parse HEAD to manage context.
Execution of a "repo verify belt" command, which is dynamically determined by reading repository documentation like AGENTS.md or README.md.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection because its core function relies on processing untrusted external data.
Ingestion points: The "Recap" section instructs the agent to "materialize each spec (fetch URL / issue / file)" provided by the user.
Boundary markers: The skill uses headers such as SPEC (materialized; this IS the spec for code-review): to delimit content in sub-agent prompts, but does not provide explicit instructions to ignore instructions embedded within those specs.
Capability inventory: The orchestrator spawns sub-agents with the ability to write code, execute git commands, and run verification scripts.
Sanitization: There is no evidence of sanitization or filtering of the materialized spec text before it is passed to the child agents.
[DYNAMIC_EXECUTION]: The skill dynamically assembles the environment for its sub-agents by reading and pasting the full content of other skill files (implement, code-review, and tdd) located in ~/.cursor/skills/. This makes the behavior of the orchestrator dependent on the current state of those external files.
[DATA_EXPOSURE]: The skill reads internal configuration and skill definition files from the user's home directory (~/.cursor/skills/) to perform its orchestration duties.

ticket-loop