The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by ingesting untrusted data from external task trackers (Jira, Linear, GitHub, etc.) to drive development actions.
Ingestion points: Task descriptions, attachments, and design references (Figma, screenshots) are read from trackers and files (SKILL.md, Phase 2.1).
Boundary markers: The skill does not define specific delimiters or instructions to ignore malicious commands embedded in task descriptions.
Capability inventory: The agent can write files, execute shell commands (git, npm, tsc), perform browser automation via javascript_tool, and manage repository states (Phase 2.4-2.10).
Sanitization: No sanitization or validation of the content fetched from the trackers is mentioned.
[COMMAND_EXECUTION]: The skill makes extensive use of local command execution to perform its primary function. It utilizes git for version control, gh/glab for platform integration, and pnpm/npm/npx for build and test verification (Phase 2.3, 2.5, 2.6, 2.8).
[SAFE]: Several security best practices are explicitly enforced within the instructions:
It prohibits the modification of .env files or any files outside the project root.
It mandates staging specific files for commits rather than using git add ., which reduces the risk of accidental secret exposure.
It uses --force-with-lease for git push operations to prevent unintentional branch overwrites.
It requires upfront user confirmation for all critical workflow parameters before starting the automated loop.

dev-task-loop