The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches content from external issue trackers (Linear, Jira, GitHub Issues, Notion) via MCP tools and prepends this data to the agent's prompt, creating a surface for injection attacks.
Ingestion points: references/ticket-resolution.md describes fetching ticket titles, descriptions, and acceptance criteria via mcp__linear__get_issue, mcp__jira__get_issue, mcp__github__get_issue, and mcp__notion__get_page.
Boundary markers: The skill uses simple text headers (e.g., [ticket:ABC-42 / ...]) to delimit fetched content but lacks explicit instructions for the agent to disregard instructions embedded within the ticket data.
Capability inventory: The orchestrator utilizes the Bash tool to execute shell scripts and git commands, and the Task tool (in background mode) to spawn sub-agents with full project access across SKILL.md and references/dispatch-contract.md.
Sanitization: No validation or sanitization is performed on the ticket description or acceptance criteria before it is merged into the agent's context.
[DATA_EXPOSURE]: The provisioning script for isolated worktrees automatically copies sensitive environment configuration files to new directories.
Evidence: scripts/setup-worktree.sh contains logic to copy .env, .envrc, and any .env.* files from the repository root to the task-specific worktree path.
[COMMAND_EXECUTION]: The skill performs its core functions by executing several local bash scripts (setup-integration-branch.sh, setup-worktree.sh, merge-worktree.sh, validate-worktree.sh). These scripts perform git operations and run project-specific validation tools like npm, pytest, and ruff based on the detected environment.

dev-orchestrator