The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs branch management operations using shell commands such as git checkout -b issue-<issue番号>. While the skill specifies that issue identifiers should be normalized, any failure in the extraction or normalization process could allow a malicious issue identifier (e.g., containing shell metacharacters) to result in command injection when the branch name is constructed and executed.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external GitHub issues during the research phase.
Ingestion points: External content enters the system through GitHub issue descriptions and implementation notes.
Boundary markers: The skill does not explicitly define boundary markers or 'ignore' instructions for the content retrieved from GitHub.
Capability inventory: The agent has extensive capabilities including shell execution (Bash), file modification (Write/Edit), and the ability to call other agents and skills.
Sanitization: While the skill mentions issue ID normalization, it lacks specific sanitization logic for the content of the issue itself, which could contain instructions intended to influence the agent's behavior during planning or implementation.
[PERSISTENCE]: The skill implements a 'learning mechanism' that updates configuration files at .agents/skills-config/plan/config.json and .agents/skills-config/review-plan/config.json. By persisting 'attentions' derived from potentially tainted implementation notes or review feedback, a malicious actor could poison the agent's future behavior across different tasks.
[DYNAMIC_EXECUTION]: The skill dynamically updates and later reads the attentions configuration. These configuration updates directly influence the prompts used in the plan and review-plan steps, effectively creating a feedback loop where untrusted implementation results modify future execution logic.
[DATA_EXFILTRATION]: The skill includes a notify-discord step that sends implementation summaries to an external Discord channel. Although this is a functional requirement, it provides a communication channel through which project summaries and major output paths are sent outside the local environment.

dev