The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions specify executing shell and PowerShell commands that incorporate a user-provided issue number (<N>). Without strict sanitization of this input by the agent, an attacker could potentially execute arbitrary commands by supplying an issue number containing shell metacharacters (e.g., ;, &, |).- [PRIVILEGE_ESCALATION]: The execution of the phase detection script on Windows uses the -ExecutionPolicy Bypass flag for PowerShell. This allows the script to run regardless of the local system's execution policy, which is a technique for bypassing security restrictions on script execution.- [INDIRECT_PROMPT_INJECTION]: The skill determines its logic and next steps based on external data fetched from GitHub issues, such as labels and specific marker comments. Because this data is controlled by external users (who can comment on or label issues), it represents an untrusted attack surface that could influence the agent's workflow.
Ingestion points: GitHub issue comments and labels processed in scripts/phase.sh (lines 52, 60) and scripts/phase.ps1 (lines 62, 79).
Boundary markers: Absent. The instructions do not include delimiters or warnings to ignore instructions embedded in the issue content.
Capability inventory: The skill dispatches to other high-capability skills (plan, work, lfg, code-review) and performs shell commands via the gh CLI based on the inferred phase.
Sanitization: The scripts use regex to extract specific progress markers, but the overall phase logic is driven by the presence of untrusted strings in markers and labels without comprehensive sanitization.

resume