The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon external data (specifications and tickets) to automate a multi-step development process. This creates an attack surface where a malicious ticket could influence the agent's behavior.
Ingestion points: The skill explicitly reads "spec and tickets" from the environment or provided context to build a task graph.
Boundary markers: There are no defined delimiters or instructions to treat ticket content as untrusted, increasing the risk that embedded instructions might be executed as commands by the subagents.
Capability inventory: The agent is granted significant autonomy to create branches, manage git worktrees, save files (including outside the repository), rebase code, and invoke other specialized tools like risk-first and code-review.
Sanitization: The instructions contain no logic for sanitizing ticket content or validating that the generated code or git operations remain within a safe scope.
[COMMAND_EXECUTION]: The workflow involves complex repository manipulations.
Evidence: The skill instructions direct the agent to perform git rebases, merges, worktree creation, and cleanup. While these are functional requirements, they constitute a capability set that can be abused if the input tickets are malicious.

build-spec