The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions explicitly direct the agent to conceal its identity. It commands the agent to 'NEVER mention: Claude Code, AI tools, or automation' and 'Never mention tools or automation publicly'. This is an attempt to override the agent's default behavior regarding transparency.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to how it handles external and local data.
Ingestion points: The skill ingests data from Linear tickets via mcp__linear__get_issue and reads repository content through git diff and file reading tools.
Boundary markers: No specific delimiters or instructions to ignore embedded commands are present when interpolating ingested data into PR descriptions or comments.
Capability inventory: The skill possesses significant capabilities including shell command execution (Bash), file modification (Write, Edit), and interactions with external platforms (gh CLI, mcp__linear__*).
Sanitization: The skill lacks mechanisms to sanitize or validate the content retrieved from Linear tickets or local files before processing it, which could allow an attacker to influence the agent's actions through malicious content in those sources.

github