The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from potentially untrusted external sources, including Git repositories, issue trackers (Jira, GitHub, Linear), and uploaded documents (Word, PDF). This creates an attack surface where malicious instructions embedded in source code comments, issue descriptions, or document text could influence the agent's behavior during the cataloging process.
Ingestion points: Git repository files/paths, Issue tracker queries (JQL, GitHub search), Word/PDF files, and external URLs.
Boundary markers: The instructions do not specify any delimiters or safety warnings to treat content from these sources as untrusted data.
Capability inventory: The skill is authorized to write files to the local file system (specifically features/.catalog/) and execute CLI commands such as git and gh (GitHub CLI).
Sanitization: No explicit sanitization or filtering of the extracted text is mentioned before the data is used to generate the catalog structure.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands to interact with version control and issue trackers.
Evidence: Mentions the use of git diff --name-status -M {baseline}..HEAD for catalog updates and gh search for retrieving issues from GitHub.

catalog-features