The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources including GitHub Pull Request bodies/comments, Slack conversations, Linear tickets, and Notion documents. This presents an attack surface where malicious instructions embedded in those sources could attempt to influence the agent's behavior during investigation.
Ingestion points: Data enters the context via the gh pr view command and various MCP tools like notion-fetch, list_issues, and search_datadog_logs across the reference playbooks.
Boundary markers: The skill uses template placeholders in references/investigator-prompt.md and references/synthesizer-prompt.md, but lacks strict programmatic sanitization for the content fetched from external sources.
Capability inventory: Subagents are explicitly spawned with readonly: false (agent mode), granting them write-capable access to MCP tools, which increases the potential impact of a successful injection.
Sanitization: The skill mitigates risks through a robust epistemic framework and mandatory quality checks requiring the agent to verify citations and surface contradictions, rather than programmatically escaping inputs.
[COMMAND_EXECUTION]: The skill uses shell commands including git log, git blame, git show, and gh pr view (in SKILL.md and references/sources/code-archaeology.md) to establish the 'code anchor' and investigate repository history.
[EXTERNAL_DOWNLOADS]: Accesses well-known external services and platforms including GitHub, Linear, Notion, Slack, Datadog, Sentry, and Databricks via MCP tools to retrieve historical evidence and runtime telemetry.

why