The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it relies on untrusted data from the repository to define its operational logic.
Ingestion points: The agent is instructed to read docs/agents/issue-tracker.md, docs/agents/vcs.md, docs/agents/stack.md, and docs/agents/quality-gates.md at skill load time (SKILL.md).
Boundary markers: There are no boundary markers or instructions provided to the agent to ignore potentially malicious content or commands embedded within these configuration files.
Capability inventory: The skill has significant capabilities, including executing shell commands (vcs.md#pr_tool), running arbitrary validation scripts (commit.validator), performing network operations (VCS push, PR creation, and issue tracker updates), and writing to the file system (git commits).
Sanitization: The skill lacks any sanitization or validation of the paths, command arguments, or tool names retrieved from the external Markdown files.
[COMMAND_EXECUTION]: The skill performs dynamic command execution based on external configuration.
The agent executes tools defined in vcs.md#pr_tool (e.g., gh or glab) and runs custom validation logic defined in quality-gates.md#gates.
It pipes data (commit messages) into a validator specified in the configuration, which could lead to command injection if the validator path or arguments are manipulated.

finalize-feature