The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to derive variables (OWNER, REPO, PARENT_NUMBER) from the user-provided ISSUE_URL and use them directly in shell commands. For example, in subagents/task-issue-creator.md, the agent is told to run gh issue view <PARENT_NUMBER> --repo OWNER/REPO and gh api repos/OWNER/REPO/issues/PARENT_NUMBER/sub_issues. If the ISSUE_URL contains shell metacharacters and the agent's parsing logic is insufficiently robust, this pattern could lead to arbitrary command execution on the host system.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from local markdown files to drive its core logic.
Ingestion points: The subagent task-issue-creator.md reads task definitions and implementation notes from docs/<ISSUE_SLUG>-tasks.md.
Boundary markers: There are no explicit boundary markers or instructions to treat the content of the task sections as untrusted text; the agent extracts content based on headings.
Capability inventory: The skill possesses significant capabilities, including the ability to create and view GitHub issues via the gh CLI and the ability to modify local files in the docs/ directory.
Sanitization: There is no mention of sanitizing or validating the content extracted from the plan file before it is interpolated into GitHub issue bodies or used to update local artifacts, allowing potentially malicious instructions in the plan to influence the agent's actions.

creating-github-child-issues