The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of system CLI tools to manage the development workflow.
Evidence: It uses git, gh (GitHub), glab (GitLab), and tea (Forgejo/Gitea) to perform operations like branch creation, commits, pushing code, and merging PRs.
[DYNAMIC_EXECUTION]: The skill explicitly instructs the agent to search for, parse, and execute arbitrary bash commands found in external project files.
Evidence: Section 3.1 and 3.5 in SKILL.md instruct the agent to identify bash commands in PULL_REQUEST_TEMPLATE.md and execute them (e.g., 'Any bash commands shown in code blocks -> Consider if they should be executed'). Although it includes a user confirmation step, the agent is acting as an execution vector for untrusted data.
[INDIRECT_PROMPT_INJECTION]: The skill's behavior is heavily influenced by the content of files within the target repository, which could be modified by third parties in a collaborative environment.
Ingestion points: Reads PULL_REQUEST_TEMPLATE.md (Section 3.1), .github/release.yml (Section 3.6), and git logs/diffs (Section 3.2).
Boundary markers: The instructions do not define clear delimiters or sanitization rules for the content read from these templates.
Capability inventory: The skill has the ability to execute shell commands, perform network operations via git/forge CLIs, and modify the local filesystem (moving PRD files).
Sanitization: There is no mention of escaping or validating the content of the templates before parsing them for actionable instructions.

prd-done