The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The example GitHub Actions configuration in assets/examples/pr-watch/github-actions.yml includes a command to install @anthropic-ai/claude-code from the NPM registry. This is a standard dependency for the intended platform and originates from a well-known provider.
[COMMAND_EXECUTION]: The skill scaffolds and uses shell scripts (e.g., loop-run.sh) to automate the execution of the agent via claude -p. These scripts are part of the core orchestration logic and include built-in safety checks, such as a kill switch and restricted tool allowlists.
[PROMPT_INJECTION]: The skill implements a 'Risk-tier ladder' (L1-L3) strategy to prevent unintended behavior. It includes an audit tool (scripts/loop-check.sh) that programmatically verifies that high-privilege modes, such as bypassPermissions, are only declared alongside isolation boundaries like containers or VMs.
[INDIRECT_PROMPT_INJECTION]: The agent loops are designed to ingest data from external sources like GitHub PRs and issues.
Ingestion points: Untrusted data from external APIs enters the environment and is stored in STATE.md to be read in subsequent runs.
Boundary markers: The run prompt templates (assets/run.template.md) use structured instructions and clear task ordering to maintain control over the agent's logic flow.
Capability inventory: The skill uses Read, Write, and Bash tools, but documentation and audit scripts emphasize restricting these to the minimum necessary set.
Sanitization: The architecture mitigates risks through its 'graduated autonomy' model, ensuring that loops are verified in a read-only 'L1' state before being granted write access in 'L2' or 'L3'.

loop-ops