The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and summarize large volumes of historical and external data which may contain adversarial instructions. \n- Ingestion points: Identified in SKILL.md, the agent retrieves data from the transcript API, repository history, issue trackers, user reports, and chat channels.\n- Boundary markers: The instructions lack explicit boundary delimiters or specific warnings to ignore instructions embedded within the retrieved historical data.\n- Capability inventory: The skill interacts with the local system using git and gh commands and leverages other skills like why and unslop.\n- Sanitization: While the skill mentions sanitizing private context before output, it lacks logic to sanitize or filter potential instructions found within input data from logs or reports.\n- [COMMAND_EXECUTION]: The skill executes shell-based development tools to synchronize with the current project state.\n- Evidence: The instructions in SKILL.md (Step 5) direct the agent to run git and gh to check the status of pull requests, branches, and tickets surfaced during the recall process.

recall