The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses several Python scripts to manage Git operations and state. Analysis of scripts like corroborate.py, make_worktree.py, and run_state.py shows that all subprocess calls are executed using argument lists rather than shell strings, preventing shell injection vulnerabilities. Additionally, inputs such as ticket IDs and commit SHAs are strictly validated using regex before being used in commands.
[INDIRECT_PROMPT_INJECTION]: The system implements a robust corroboration mechanism (found in SKILL.md and corroborate.py). It treats completion claims in tickets as unverified until they are verified against Git history. This prevents an attacker-controlled ticket from bypassing implementation steps or claiming unearned success.
[DATA_EXPOSURE]: The workflow enforces context isolation for subagents. According to the SKILL.md invariants and the references/ticket-format.md guidelines, each worker is provided with a bounded brief containing only the specific ticket and necessary code pointers, rather than the entire conversation or repository context. This minimizes the exposure of sensitive data to less capable or untrusted subagent models.
[PRIVILEGE_ESCALATION]: The install_skill.py script facilitates the installation of the skill and its agent profiles into user-level configuration directories (e.g., ~/.omp/agent/ and ~/.zcode/agents/). While this involves writing to files outside the immediate project scope, the behavior is documented, requires explicit user invocation, and is necessary for the skill to integrate with its supported host platforms.

ticket-driven-development