The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external issue trackers and planning specifications to define its execution plan.
Ingestion points: The agent reads issue bodies and comments from trackers (e.g., GitHub Issues via gh CLI) in steps 1 and 3 of SKILL.md to establish requirements and acceptance criteria.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are defined for the content fetched from the tracker.
Capability inventory: The skill possesses significant capabilities including editing local files, creating/removing git worktrees, running arbitrary repository setup/check commands, and launching parallel sub-agents (workers).
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from external issue trackers before it is used to brief worker agents or generate plans.
[COMMAND_EXECUTION]: The skill is designed to run repository-defined commands, which could lead to the execution of malicious scripts if the repository content is untrusted.
Evidence: Step 5 and 8 in SKILL.md explicitly instruct the agent to run "the repository's documented setup command", "focused checks", and "the project's development server script".
Context: While this is standard for development tools, it allows the repository configuration to dictate what code is executed on the host system.
[EXTERNAL_DOWNLOADS]: The skill lists several dependencies that are loaded at runtime.
Evidence: SKILL.md references code-cleanup, code-review, tdd, and triage from the snappedly/skills package.
Trust: These resources are from the same vendor as the skill author ('snappedly') and represent expected modular functionality.

execute