The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the gh (GitHub CLI) tool via the Bash tool to manage configuration and store reports. Evidence: SKILL.md contains multiple shell commands such as gh issue list, gh issue view, gh issue create, and gh issue edit to interact with the project repository.
[PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it processes data from external GitHub issues which could be modified by third parties. Ingestion points: Issue bodies labeled tunan:config and tunan:project are read in Phase 0 and Phase 1.0 of SKILL.md. Boundary markers: The skill does not define clear boundaries or 'ignore' instructions for the content read from these issues. Capability inventory: The agent can execute shell commands via Bash and perform file system operations with Read, Write, Glob, and Grep tools. Sanitization: There is no evidence of sanitization or filtering of the text retrieved from the GitHub issues before it is used to influence the skill's behavior.
[SAFE]: The skill incorporates several security best practices and design constraints to protect user data and system integrity. Evidence: The instructions in SKILL.md and references/interview.md explicitly prohibit the use of read-write database credentials and mandate that no Personally Identifiable Information (PII) be included in the generated reports.

product-pulse