The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process data from external GitHub issues and existing repository files. This content is untrusted and could contain instructions meant to hijack the agent's behavior.
Ingestion points: GitHub issue descriptions and comments fetched via gh issue view during the triage and research steps.
Capability inventory: The skill and its subagents have broad access to the local environment, including Bash execution, file modification (Write/Edit), and the ability to spawn powerful subagents using the Agent tool.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish between its own system instructions and potentially malicious directions embedded within retrieved issue text.
Sanitization: The skill does not perform sanitization or validation of the text retrieved from external sources before processing it.
[COMMAND_EXECUTION]: The pipeline heavily relies on shell command execution via the Bash tool for repository management (Git), issue tracking (GitHub CLI), and code analysis (Grep, Ripgrep). While these are core functionalities, they represent a significant capability that could be abused if the agent follows malicious instructions from an issue.
[PERSISTENCE]: During the initial setup, the skill automatically copies several agent definition files from its assets/agents/ directory to the local configuration directory ~/.claude/agents/. While this is the standard method for defining subagent profiles in Claude Code, it constitutes a persistent modification of the user's environment outside the immediate project workspace.

dev