The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute various shell commands, including Git operations (checkout, pull, push, worktree), GitHub CLI operations (gh issue, gh pr), and package management commands (npm, pip). These are typical for project management but provide a significant surface area for interaction with the local environment.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the interpolation of external, potentially untrusted data into shell commands.
Ingestion points: The skill uses variables like {issue-number}, {slug}, and {description} in shell commands such as git checkout -b squad/{issue-number}-{slug} and gh pr create --title "{description}" (SKILL.md).
Boundary markers: No explicit boundary markers or instructions are provided to the agent to treat these interpolated values as untrusted or to ignore instructions embedded within them.
Capability inventory: The agent has the capability to execute commands that modify the repository state, create PRs, and install packages locally, which could be abused if malicious content is injected via the issue tracker.
Sanitization: The instructions lack any requirement for input validation or escaping of shell metacharacters before the values are passed to the command line execution environment.

git-workflow