The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process untrusted input from external issue trackers (GitHub, GitLab, Jira, Linear) including issue descriptions and comments to drive workflow steps. While tracker-integration.md includes instructions to treat this as data, the ingestion of external content into the agent's decision-making loop is a recognized attack surface.
Ingestion points: Issue summaries, descriptions, and comments retrieved via CLI or MCP tools (documented in tracker-integration.md).
Boundary markers: Uses automation markers like  to identify and separate agent-generated state from human comments.
Capability inventory: Git operations (commit, push), tracker API interactions (PR creation, commenting), Node.js execution for internal logic, and subagent spawning via the lane system.
Sanitization: Sanitizes commit summaries by removing newlines and tabs, and restricts git staging to a specific, hardcoded path allowlist (ADR-433) in commit-step.sh.
[COMMAND_EXECUTION]: The skill makes extensive use of system commands including git, node, gh, and glab across its Bash and PowerShell scripts to manage repository state and interact with external trackers. Although the scripts generally validate arguments using regular expressions and sanitize inputs, the overall complexity of these shell interactions across 15 files increases the potential for command injection if validation logic is bypassed.
[DYNAMIC_EXECUTION]: The skill uses node -e to execute embedded JavaScript logic for complex JSON processing and ownership resolution within its shell scripts. Additionally, the lane system described in lanes.md allows the executor to spawn external CLI runtimes based on configurations provided in mission.yml, constituting dynamic process execution at runtime.

factory-runbook