The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and summarize data from external, potentially untrusted sources such as issue trackers, pull requests, and CI logs. This creates a surface where malicious instructions embedded in these external sources (e.g., in a PR title or description) could influence the agent's behavior, especially given its autonomous fix capabilities.
Ingestion points: SKILL.md specifies reading from CI, main, open PRs, lanes/agents activity, trackers, and benchmark results.
Boundary markers: Absent. The instructions do not define clear delimiters or headers to distinguish between project data and agent instructions.
Capability inventory: SKILL.md grants the agent authority to "fix" problems via commands like "relaunch", "dispatch", and "rebase" without immediate user confirmation.
Sanitization: Absent. There are no instructions to sanitize or validate the content of the external data before processing.
[COMMAND_EXECUTION]: The skill encourages the agent to autonomously execute shell-like operations or git commands.
Evidence: SKILL.md contains the instruction: "If you are the orchestrator and the fix is obvious and reversible (relaunch, dispatch, rebase), fix it, then report it in one line. Don't make the user ask."

status