The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directs the agent to execute shell commands to perform punctuation checks and retrieve project context.
Evidence: SKILL.md contains a 'Punctuation Gate' section that instructs the agent to run a bundled bash script (check-punctuation.sh). Additionally, references/mode-public-reply.md and references/mode-release-notes.md instruct the agent to use the GitHub CLI (gh issue view, gh pr view, gh release view).
Risk: Parameters such as issue numbers or file paths are interpolated into these shell commands. If these inputs are sourced from untrusted data without validation by the execution environment, they could be leveraged for command injection.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process arbitrary user-provided text, creating a surface for indirect prompt injection.
Ingestion points: The skill reads external files, repository content, and pasted text as described in SKILL.md and its reference files.
Boundary markers: The instructions do not define explicit boundary markers or 'ignore embedded instructions' warnings for the text being processed.
Capability inventory: The agent has access to shell execution via bash and the gh tool, which could be abused if an injection is successful.
Sanitization: No sanitization or filtering of instructions within the ingested text is performed, as the skill's purpose is linguistic polishing rather than security analysis.

write