The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub Issue bodies and comments, as well as local Markdown files. Maliciously crafted content in these sources could attempt to influence the agent's behavior during the decision-map workflow.
Ingestion points: Reading GitHub issue content via the gh CLI and local files in docs/decision-map/ as documented in SKILL.md and implemented in scripts/github_map_ops.py and scripts/local_map_ops.py.
Boundary markers: The skill uses specific HTML comment markers (e.g., ) to delimit tool-managed regions within documents, as defined in scripts/map_core.py.
Capability inventory: The skill can execute shell commands via subprocess.run (primarily calling the gh CLI) and perform file system writes to local Markdown files, as seen in scripts/github_map_ops.py and scripts/local_map_ops.py.
Sanitization: The skill implements a scrub function in scripts/map_core.py that escapes tool-specific marker prefixes (e.g., converting <!-- decision-map: to <!-- decision-map:) in user-supplied strings before they are written to disk or the tracker.
[COMMAND_EXECUTION]: The Python scripts utilize subprocess.run to interact with the GitHub CLI (gh).
Evidence: The GhApi class in scripts/github_map_ops.py executes commands like ["gh", "api", ...] using subprocess.run.
Context: Command arguments such as repository names and ticket numbers are validated against a strict regex (SAFE_SLUG_RE) in scripts/map_core.py to prevent shell injection and path traversal. Data payloads are passed via JSON-encoded stdin to the gh binary, which is a robust way to handle potentially complex strings.

work-map