The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions specifically recommend recording "credentials location" in resolution comments on an issue tracker. Issue trackers are collaborative environments often lacking the necessary security controls for managing secrets, and this practice could lead to the exposure of sensitive information to unauthorized users.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection as it is designed to ingest and act upon data from untrusted external sources.
Ingestion points: The agent reads the map issue, child tickets, and results from "research" subagents which fetch data from third-party APIs, documentation, and local resources.
Boundary markers: There are no instructions provided to treat ingested data as untrusted or to ignore instructions embedded within the research results or issue comments.
Capability inventory: The skill has the ability to create and modify issues, spawn subagents to perform further actions, and invoke additional skills specified in the "Notes" section of the map.
Sanitization: The skill lacks any mechanism for sanitizing, validating, or escaping content retrieved from the issue tracker or external research tasks before processing it or using it to steer subsequent actions.
[INDIRECT_PROMPT_INJECTION]: The "Notes" section in the map issue allows for specifying other "skills every session should consult." This creates a dynamic steering mechanism where an attacker who gains access to the issue tracker could modify the map to force the agent to invoke malicious skills or tools during subsequent planning sessions.

wayfinder