The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from local repository files which could potentially contain malicious instructions.
Ingestion points: The skill reads delivery-status.md and delivery-plan.md to determine the current phase, expected output, and acceptance requirements (SKILL.md, Step 1).
Boundary markers: There are no explicit delimiters or instructions for the agent to ignore or sanitize embedded instructions within these external files.
Capability inventory: The skill has access to the Bash tool, enabling arbitrary command execution, and uses git and gh CLI for remote repository modifications (SKILL.md, Steps 1-5).
Sanitization: No validation or sanitization of the input file content is performed before the agent uses it to decide on branch transitions or commit contents.
[COMMAND_EXECUTION]: The skill relies on the Bash tool to execute complex shell commands including git operations, gh (GitHub CLI) for pull request management, and CI/CD monitoring (SKILL.md, Steps 1-5). While these are standard for the stated purpose, the broad capability is a necessary component for the indirect injection surface.

ship-it