The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes workflow instructions and configuration data from local files within the repository (e.g., card-loop/board.md, card-loop/brief.md, card-loop/backlog/*.md). This design creates a surface for indirect prompt injection if an attacker can modify these files (e.g., via a malicious pull request or a compromised repository).
Ingestion points: The agent reads project-level settings from card-loop/board.md, high-level task descriptions from card-loop/brief.md, and specific technical requirements from files in card-loop/backlog/.
Boundary markers: While the instructions state that a human must "accept the draft" of these files before they are used, there are no explicit boundary markers or instructions to the AI to ignore malicious directives embedded within the content once it is loaded into the agent's context.
Capability inventory: The skill is capable of executing shell commands (via TEST_CMD, SETUP_CMD, etc.), performing file system writes, executing git operations, and dynamically loading other skills based on names found in the configuration.
Sanitization: There is no evidence of sanitization or validation performed on the commands or instructions retrieved from the repository files before they are processed or executed.
[COMMAND_EXECUTION]: The skill is designed to automatically execute shell commands specified in the card-loop/board.md file, including <TEST_CMD>, <SETUP_CMD>, <TYPECHECK_CMD>, and <LINT_CMD>. While these are intended for legitimate development tasks like testing and linting, this mechanism allows for the execution of arbitrary commands if the configuration file is poisoned.
[DYNAMIC_EXECUTION]: The skill supports dynamic invocation of other agent skills based on identifiers listed in the <TEK_SKILLS> and <REPO_SKILLS> fields of the board configuration. This allows for the runtime extension of the agent's capabilities based on potentially untrusted data found in the repository.

jt-card-gate