The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from GitHub issues and external specification files, which are interpolated into prompts for planning and implementation agents.
Ingestion points: Issue bodies retrieved via gh issue view and specification files such as spec.md.
Boundary markers: The skill uses XML-like delimiters (e.g., <paste source.md>, <plan>, <tasks>) to isolate external content within agent prompts.
Capability inventory: The controller has extensive capabilities, including shell access via Bash, file operations (Write, Edit, Glob), and the ability to dispatch subagents and use the GitHub CLI.
Sanitization: The workflow incorporates multiple automated review stages (spec-reviewer, plan-reviewer, and validating-specs) that audit generated artifacts before they are executed or committed.
[COMMAND_EXECUTION]: The scripts/quality-gates.sh script executes arbitrary commands derived from the repository's configuration, such as npm run test or cargo test. This allows for the execution of code defined in the target repository's build files as part of the verification process.
[DATA_EXFILTRATION]: The skill includes functionality to push code to a remote repository via scripts/git-sync.sh and can send status updates to an external webhook URL via scripts/notify.sh. These operations are legitimate components of the skill's primary purpose for remote deployment and notification.
[EXTERNAL_DOWNLOADS]: The skill utilizes WebFetch to retrieve external documentation and interacts with MCP servers to query library and framework information during the research phase.
[CREDENTIALS_UNSAFE]: The skill proactively manages credential safety by providing a setup/hooks/block-env-reads.sh hook, which is designed to prevent the agent from accessing sensitive files like .env or SSH keys, following security best practices.

agentic-loop