The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on executing shell commands through tools like git, gh, and xref to inspect the state of repositories and pull requests. It also explicitly mentions using "deployment CLIs" to verify deployment status, which introduces a dependency on the security and configuration of the environment's installed tools.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, creating an attack surface where malicious instructions could be embedded in data processed by the agent.
Ingestion points: The agent reads volatile data from GitHub objects (issues, pull-requests, reviews, comments), local Git checkouts, package registries, and "handoff" files which are treated as discovery indexes (SKILL.md, Sections 1 & 3).
Boundary markers: The instructions state "Never promote prose into observed fact" (SKILL.md, Section 2), but there are no strict structural delimiters or explicit warnings provided to the LLM to ignore instructions found within the ingested content.
Capability inventory: The skill uses git, gh, xref, and unspecified "deployment CLIs" (SKILL.md, Frontmatter & Section 3).
Sanitization: The skill does not define any sanitization, escaping, or filtering of the external content before it is processed by the agent.

workstream-reconcile