The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub issues and pull requests which could contain malicious instructions.
Ingestion points: Uses df-ti and df-tpr to read issue bodies, pull request bodies, comments, and review comments in Step 2.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are used when processing this external text.
Capability inventory: The skill has access to shell execution (git, herdr, wt), file system access, and the ability to start new agent sessions.
Sanitization: No sanitization of the ingested issue/PR content is mentioned before it is processed or used to influence the workflow.
[DATA_EXFILTRATION]: The skill accesses sensitive local directories to maintain session state.
Evidence: Accesses ~/.claude/projects/ to read session transcripts (in .jsonl format) to extract session IDs for resumption in Step 5.
Evidence: Reads from ~/.agents/skills/work-branch-name-gen/SKILL.md to follow instructions for branch naming.
[COMMAND_EXECUTION]: The skill makes extensive use of local shell commands to manage the git environment and workspaces.
Evidence: Executes wt, gt, git, jq, herdr, ls, printf, and sed throughout the workflow.
Risk: While these are intended for development, the construction of shell commands using variables derived from branch names or paths (e.g., in Step 5) requires careful handling to prevent unintended execution patterns.
[DYNAMIC_EXECUTION]: The skill dynamically starts new agent sessions and passes user-provided arguments to them.
Evidence: In Step 5, it uses herdr agent start and herdr agent prompt to initiate a new Claude session and passes the /work-start <original arguments> string to it.

work-start