The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, potentially untrusted sources, which could contain malicious instructions.
Ingestion points: Processes content from the 'shared record', including 'user reports', 'issue tracker', and 'chat and issue channels' as described in Step 4 of SKILL.md.
Boundary markers: While the skill instructs subagents to 'grep the topic first', it lacks explicit boundary markers or delimiters for separating untrusted external content from system instructions during processing.
Capability inventory: The skill has access to the filesystem (ls), version control (git), and the GitHub CLI (gh), and can spawn subagents to process data.
Sanitization: The instructions include a requirement to 'sanitize private context before any public output', which serves as a security control, though it does not fully prevent the AI from obeying instructions embedded in the ingested data.
[COMMAND_EXECUTION]: The skill executes standard system and developer tools to inspect the environment and verify the project state.
Evidence: Step 3 in SKILL.md utilizes ls -t to order files by modification time. Step 5 uses git and gh tools to verify the status of pull requests, branches, and tickets surfaced during the mining process.

recall