The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests untrusted data from external sources like GitHub Issues and Linear tickets, as well as local project files, without providing the agent with boundary markers or instructions to ignore embedded commands.
Ingestion points: File content reads (via glob patterns) and GitHub Issue content retrieved via the GitHub CLI.
Boundary markers: Absent. The prompt does not provide delimiters or instructions to treat ingested data as non-executable text.
Capability inventory: The skill has the capability to read local files and use the gh tool to interact with remote repositories.
Sanitization: No sanitization or validation of the ingested content is performed before it is processed by the agent.
[COMMAND_EXECUTION]: The skill instructs the agent to use the GitHub CLI (gh issue list, gh issue view) to fetch data. This is a routine operation for developer tools and is consistent with the skill's stated purpose.
[DATA_EXPOSURE]: The skill writes execution metadata to ~/.claude/projects/skill-telemetry.md. While this is intended for a 'self-evolution' telemetry pipeline, users should be aware of persistent logging of their activity within hidden configuration directories.

dep-map