The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes the GitHub CLI tool (gh) through a wrapper script (github-facts.mjs). This wrapper restricts system interactions to a strict allowlist of read-only operations, such as fetching issue metadata and PR state, thereby preventing arbitrary command execution.\n- [DYNAMIC_EXECUTION]: The skill executes local Node.js scripts for validation and state management. These scripts use dynamic imports to load the skill's own core logic from the local filesystem, which is a common and safe pattern for modular toolsets.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub issue bodies and comments, creating an attack surface for indirect prompt injection. It successfully mitigates this risk by providing prescriptive instructions to the agent to treat ticket data as non-authoritative requirements and by using SHA-256 hashes to pin those requirements across implementation stages.\n- [EXTERNAL_DOWNLOADS]: The skill allows the use of npm ci to manage project-specific dependencies. This is a standard software development operation and is executed within the context of the user's current repository checkout.

implement-this