The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from external sources.
- Ingestion points: User requests (free text or URLs) and external repository metadata (names and descriptions) retrieved from GitHub, npm, crates.io, and PyPI as described in SKILL.md.
- Boundary markers: Instructions require wrapping content in specific Markdown sections like ## User intents (verbatim) and ## Reuse research to delimit untrusted input.
- Capability inventory: The skill can write to the filesystem (creating docs/business.md and spec files), execute the gh (GitHub) CLI, and perform git commits.
- Sanitization: The skill mandates the redaction of secrets (tokens, passwords, keys, PII) using [REDACTED] markers and includes a fallback to stop execution if secret identification is uncertain.
[COMMAND_EXECUTION]: The skill uses the GitHub CLI (gh) to perform repository searches. This is an expected and legitimate use of developer tooling for the skill's stated purpose of research.
[SAFE]: The skill explicitly forbids implementation (writing code) and limits its actions to documentation and metadata search, which significantly reduces the potential impact of any malicious data it might encounter.

mo-reuse