The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process output from a subagent (another LLM) and repository content (uncommitted changes, design documents, task summaries). This creates a vulnerability surface where data provided to the agent could attempt to influence its behavior or subvert its instructions.
Ingestion points: Subagent output and repository files (code, design documentation, implementation plans) processed during the review and consultation steps in SKILL.md.
Boundary markers: The instructions do not mandate specific delimiters or "ignore embedded instructions" warnings when processing the subagent's response or the repository data.
Capability inventory: The agent is authorized to use Bash (for command execution) and the Agent tool (for spawning subagents) as described in SKILL.md.
Sanitization: There is no mention of sanitizing, escaping, or filtering the content retrieved from the repository or the subagent before it is processed or reported to the user.
[COMMAND_EXECUTION]: The skill explicitly instructs the agent to use a Bash tool to execute shell commands (e.g., gh pr view) to manually verify information if a subagent execution fails or returns insufficient data, as noted in the 'subagentの実行失敗を検知した場合' section of SKILL.md.

subagent-consultation