The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It is instructed to read and process external data from GitHub issue bodies and comments, as well as repository-based documentation, to guide its autonomous behavior. Ingestion points include Step 0 (Grounding) in SKILL.md. There are no explicit boundary markers or sanitization implemented to prevent malicious input from hijacking the agent's logic. This is critical given its capabilities to manage Git repositories and interact with the GitHub CLI.
[DYNAMIC_EXECUTION]: The configuration resolver (config.py) loads settings from the local repository being analyzed, specifically through the files '.lead/config' and '.lead/models.json'. These settings define the specific CLI commands and model routing used for dispatching sub-agents. A malicious repository could provide these files to override execution logic and redirect the agent to run arbitrary shell commands with the user's privileges.
[COMMAND_EXECUTION]: The agent framework makes extensive use of shell commands to manage Git worktrees, interact with the GitHub CLI, and invoke sub-agents. This broad capability increases the potential impact of other vulnerabilities, such as the configuration overrides mentioned above.
[EXTERNAL_DOWNLOADS]: The documentation references an external Node.js package (@tamng0905/builder-essential-skills) for installation. This package is hosted on a public registry and is not explicitly verified or controlled by the skill's defined environment, introducing a supply chain dependency risk.

lead