The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses eval to execute the output of the flowctl rp setup-review command in workflow.md and flowctl-reference.md. This pattern of dynamic execution can be risky if the tool output is influenced by untrusted external data.\n- [COMMAND_EXECUTION]: The skill implements an automated 'Fix Loop' in SKILL.md and workflow.md that performs git add and git commit operations without user confirmation. While intended for automation, this could lead to unintended repository changes if the AI backend provides incorrect or malicious 'fixes'.\n- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8). It ingests untrusted data from the repository (epic specs, task descriptions, and source code) and interpolates it directly into a prompt sent to an external reviewer (RepoPrompt).\n
Ingestion points: workflow.md reads epic specs via $FLOWCTL cat, task lists via $FLOWCTL tasks, and source code via git diff.\n
Boundary markers: The skill uses markdown headers and an XML-like <file_contents> section in workflow.md to delimit data, but lacks robust protection against adversarial content that mimics these boundaries.\n
Capability inventory: The agent can execute shell commands via flowctl, write temporary files to /tmp, and modify the git repository's history.\n
Sanitization: There is no evidence of sanitization or escaping applied to the content of the specs or code files before they are interpolated into the prompt sent to the AI reviewer.

flow-next-epic-review