The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from external and local sources, creating a risk that malicious instructions within those sources could influence agent behavior.
Ingestion points: GitHub issue content fetched via gh issue view and local implementation plans read from tmp/issues/<issue番号>/plan.md.
Boundary markers: Absent. The instructions do not define specific delimiters or warnings to ignore instructions found within the issue description or plan content.
Capability inventory: The agent has access to powerful tools like Bash, Write, and Edit, allowing it to modify the codebase or execute shell commands based on injected instructions.
Sanitization: Absent. No sanitization or validation of the ingested content is performed before it is used to guide implementation decisions.
[COMMAND_EXECUTION]: The skill provides a shell script template for generating patches that incorporates user-controllable arguments directly into the command string.
Evidence: The patch generation logic interpolates the <issue番号> argument into a shell redirection path: > tmp/issues/<issue番号>/diff.patch.
Risk: This pattern creates a potential command injection surface if the issue identifier contains shell metacharacters (e.g., ;, $(...), or backticks), as the skill lacks explicit validation or escaping for this variable before shell execution.

implement