The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes dynamic context injection syntax (!) in Phase 0.0 to execute a vendor script (discover-config.sh) at load time. More significantly, in Phase 0.2, it uses eval to execute shell commands dynamically generated by the ${CLAUDE_PLUGIN_ROOT}/scripts/for-each-board.sh script. Since the output of this script is influenced by Trello board metadata, executing the resulting string as code presents a command injection risk.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its handling of untrusted data from GitHub and Trello.
Ingestion points: Item titles and descriptions are fetched from external backends in Phase 0.2.
Boundary markers: There are no explicit delimiters or specific instructions provided to the LLM to ignore potentially malicious content within the ingested item descriptions when they are passed to brainstorming and writing-plans skills.
Capability inventory: The skill has permissions to read, write, and edit local files (via Bash), execute GitHub CLI commands, and interact with Trello boards.
Sanitization: No sanitization or validation of external content is performed before it is interpolated into prompts or used in automated evaluations.

triage