The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions direct users to download code from https://github.com/UrRhb/agentflow.git. This repository belongs to an unverified community account and is not associated with a recognized trusted organization.
[PERSISTENCE]: The installation guide requires users to add a script (~/.claude/sdlc/agentflow-cron.sh) to their crontab. This enables persistent background execution of the skill's logic every 15 minutes, allowing it to maintain access and perform operations outside of an active user session.
[REMOTE_CODE_EXECUTION]: The skill facilitates the execution of remote code by cloning a third-party repository and running its components as workers (/sdlc-worker) or plugins (/plugin install agentflow). This allows unverified code to execute arbitrary shell commands on the user's system.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to read task descriptions and comments from external Kanban platforms such as Asana, GitHub Projects, and Linear. These external inputs are ingested into the AI's context to drive automated development workflows. While the documentation notes that board content is 'untrusted data', the lack of strict schema enforcement for these text fields creates an attack surface where an external actor could provide malicious instructions that influence the agent's behavior, potentially leading to unauthorized repository modifications or data exposure.
Ingestion points: Kanban board task descriptions and user comments (SKILL.md).
Boundary markers: The skill documentation includes warnings to treat board content as untrusted and to validate actors, but does not provide technical implementation of delimiters.
Capability inventory: The skill can spawn Claude Code workers, create Pull Requests, execute crontab scripts, and modify project files.
Sanitization: The skill mentions manual validation of transitions but relies on the LLM to interpret free-form text from external tools.

agentflow