The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill is designed to handle sensitive GitHub App private keys (.pem files) and installation tokens.
Both the impl-bot and review-bot are instructed to access these secrets via shell commands (source .orchestrator/.bot-env.impl and node .orchestrator/app-token.js), which typically bypasses platform-level file-read protections.
The IMPLEMENT-AGENT.md playbook explicitly instructs the agent to embed a GitHub installation token in a plaintext URL during the git push command (https://x-access-token:${GH_TOKEN}@github.com...), a practice that can expose the token in shell history, process lists, or log files.
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection due to its operational model.
Ingestion points: The impl-bot and review-bot agents ingest the task specification and the "approved approach" directly from GitHub issue bodies and comments using gh issue view --comments.
Boundary markers: There are no instructions or delimiters provided to help the agents distinguish between legitimate instructions and malicious content injected by third parties into GitHub comments.
Capability inventory: The agents have high-privilege capabilities, including writing to the repository, pushing commits to remote branches, and executing arbitrary "test commands" defined in the project's configuration via Bash.
Sanitization: The skill lacks any mechanism to sanitize or validate the content retrieved from GitHub issues before it is used to guide the agent's actions.

run-devops-with-orch-impl-rev