The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it ingests data from several external sources to inform its planning process. This includes GitHub issues via the gh CLI, Slack conversations via the slack-researcher agent, and general web content via the web-researcher agent.
Ingestion points: Data enters the agent context through gh api calls (SKILL.md), Slack thread reads (slack-researcher.md), and web fetching (web-researcher.md).
Boundary markers: The skill includes explicit instructions for its research agents in web-researcher.md and slack-researcher.md under the 'Untrusted Input Handling' sections, directing them to ignore instructions or tool calls within fetched content and focus only on extracting factual data.
Capability inventory: The skill possesses the ability to write to the local filesystem (temporary files), write to GitHub (comments and issues), and invoke subsequent implementation skills like work.
Sanitization: The primary defense is the prompt-level instruction to the sub-agents to treat external content as data rather than instructions.
[EXTERNAL_DOWNLOADS]: The skill references and recommends the installation of the official GitHub CLI from https://cli.github.com. This is a well-known and trusted source for developer tools.
[COMMAND_EXECUTION]: The skill performs extensive shell command execution using the gh CLI to manage GitHub resources. It also executes a local Python script (repo-profile-cache.py) to manage a project profile cache. These operations are core to the skill's functionality and are performed within the local repository context.

plan