The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process untrusted external data, including GitHub comments, PR descriptions, and issue artifacts. This creates a potential attack surface where malicious instructions could be embedded in these external sources to influence the agent's behavior. * Ingestion points: Identified in references/2026-05-12_user-artifact-before-agents.md and references/2026-05-21_github-url-fetch-before-grep.md, where the agent is instructed to fetch and read URLs, PR numbers, and GitHub comments provided in the prompt. * Capability inventory: The agent has extensive capabilities including shell execution (bash), file manipulation (Edit, Write), and the ability to invoke other skills via the Skill() tool, as detailed throughout SKILL.md. * Boundary markers & Sanitization: The skill includes strong defensive principles. references/2026-08-25_feedback-is-not-plan.md warns against treating user-supplied artifacts as approved plans. Phase 1 requires explicit plan validation, and Phase 5.5 mandates an adversarial review gate (wk-adversarial-review) to inspect all changes before they are finalized.
[METADATA_POISONING]: The YAML frontmatter in SKILL.md and several reference files contain non-existent or futuristic model versions (e.g., 'gpt-5.6-sol', 'gemini-2.5-flash') and future timestamps (2026). This metadata is technically deceptive but appears to be a stylistic choice or aspirational projection by the author rather than a malicious attempt to subvert the agent's execution environment.
[DYNAMIC_EXECUTION]: The skill documents a fallback mechanism for binary file replacement using Python one-liners when standard editing tools fail, as seen in references/2026-06-11_edit-tool-null-byte.md. While this involves the dynamic generation and execution of code, it is constrained to specific utility tasks and presented as a developer best practice.

wk-workflow