The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to invoke the copilot and gh CLI tools to communicate with other repositories. Specifically, Pattern 0 recommends using the --allow-all-tools flag, which disables manual confirmation for tool executions, potentially allowing unauthorized actions if the target repository or its configuration is compromised.
[DYNAMIC_EXECUTION]: Pattern 0 involves the dynamic generation of prompt strings which are written to temporary files and subsequently executed via shell commands using Start-Process or subshell expansion (e.g., copilot -p (Get-Content $promptFile -Raw)). This pattern of generating and executing code/instructions at runtime increases the risk of command injection.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process information from external "peer" repositories (Patterns 1 and 2), creating a vulnerability to indirect prompt injection where malicious content in those repositories could influence the agent's behavior.
Ingestion points: Metadata files in peer repositories such as .squad/team.md, .squad/decisions.md, and request/response YAML files in .squad/cross-squad/.
Boundary markers: The skill suggests using text-based markers like [CROSS-SQUAD REQUEST], but these are easily bypassed by adversarial content.
Capability inventory: The skill has access to the file system (read/write), process spawning (copilot), and network-capable tools (gh).
Sanitization: There is no evidence of sanitization or strict schema validation for the data read from external repositories.

cross-squad-communication