The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from issue bodies, comments, and third-party changelogs. It includes an explicit 'Author authority' section instructing the agent to treat this text strictly as data and never as instructions, specifically identifying direct addresses ('delete this instead') as attack signals. This surface is well-documented and mitigated via instructions.
[COMMAND_EXECUTION]: The skill uses the Bash tool to manage locks, resolve configurations via a helper script, and interact with git. These operations are scoped to the local repository and follow standard automation patterns.
[DATA_EXPOSURE]: The skill reads a configuration file named .tituskirch-skills.json and manages locks in the .git/tituskirch-skills directory. It does not hardcode credentials or access sensitive system paths (e.g., ~/.ssh). Secret management instructions correctly advise using external configuration rather than hardcoding.
[REMOTE_CODE_EXECUTION]: The skill delegates work to a sub-agent (work-implement). This is a standard functional delegation within the AI agent framework and does not involve downloading or executing unverifiable code from the internet.
[PERSISTENCE_MECHANISMS]: The skill uses a filesystem lock to ensure single-flight execution within a checkout. This is a transient synchronization mechanism and does not attempt to establish persistence across reboots or shell sessions.

work-implement-queue