The Agent Skills Directory

[COMMAND_EXECUTION]: The script gate.py executes shell commands extracted from the card-loop/board.md file and related card backlog files. This includes commands specified in fields like TEST_CMD, SETUP_CMD, and browser-related automation steps (starting a tool and performing click actions).
[INDIRECT_PROMPT_INJECTION]: The skill processes external markdown files (card-loop/board.md, card-loop/backlog/*.md, card-loop/brief.md) that contain instructions and command definitions. An attacker who can influence the content of these files (e.g., through a malicious Pull Request or shared repository access) could inject arbitrary shell commands that the agent would execute when running the gate script.
Ingestion points: The skill reads task metadata and command strings from card-loop/board.md and card-loop/backlog/{card_id}.md in the load_board, read_board_text, and _read_card functions.
Boundary markers: The script uses regex-based parsing to isolate command fields but does not implement prompt-level delimiters or specific instructions for the agent to ignore embedded instructions within these data sources.
Capability inventory: The script can execute arbitrary shell commands via subprocess.run(shell=True) and subprocess.Popen(shell=True), manage Git worktrees, and modify the project's board.md file.
Sanitization: There is no evidence of sanitization, escaping, or validation of the command strings retrieved from markdown files before they are passed to the system shell for execution.
[DYNAMIC_EXECUTION]: The _run_shell and _click_surface functions in gate.py use subprocess.run and subprocess.Popen with shell=True to execute command strings that are dynamically parsed from markdown content at runtime.

jt-next-step