The Agent Skills Directory

[PROMPT_INJECTION]: The skill is highly exposed to indirect prompt injection because it ingests untrusted data from GitHub and GitLab issue bodies and comments.
Ingestion points: External data enters the agent context via gh issue view --comments and glab issue view --comments in Phase 1.
Boundary markers: The skill lacks explicit delimiters or instructions for sub-agents to ignore potentially malicious content embedded within the fetched issue text.
Capability inventory: The agent has broad capabilities including shell command execution, Git worktree management, local file system writes, and environment variable propagation.
Sanitization: There is no evidence of filtering or sanitizing external content before it is interpolated into prompts for implementation sub-agents.
[COMMAND_EXECUTION]: The skill performs several potentially risky shell operations and environment manipulations.
Env Propagation: The logic in Phase 3 automatically copies .env files from a worktree back to the main project directory. If an injected instruction manages to modify an .env file within the worktree context, those changes (potentially including malicious configurations) are persisted to the main environment.
Worktree Management: The skill creates and removes directories using shell commands based on issue numbers, which could be exploited if issue numbers or titles are manipulated to include path traversal characters, though the risk is mitigated by standard CLI behavior.
[EXTERNAL_DOWNLOADS]: The skill encourages the installation and execution of external tools.
The instructions direct the agent to run npx fallow audit for TypeScript/JavaScript projects and suggests the user install it if missing. While fallow is a legitimate auditing tool, executing unversioned packages from a public registry introduces a minor supply chain risk.

work-on-issues