The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it autonomously ingests and acts upon data from external sources. Ingestion points: The agent reads titles, bodies, and comments from an issue tracker and various PR comments in SKILL.md. Boundary markers: The instructions use 'context pointers' and structured markdown headers (## AFK summary) for state tracking, though these are not cryptographic boundaries. Capability inventory: The skill manages git branches and worktrees, and has the authority to merge pull requests and delete branches. Sanitization: No explicit validation or filtering of tracker-provided text is defined before sub-agents process the issue content.
[COMMAND_EXECUTION]: The skill uses shell commands via git and gh tools to manage repository state, including creating worktrees, switching branches, and merging pull requests.
[REMOTE_CODE_EXECUTION]: The agent executes the project's test and check suites on implementation branches. This involves executing arbitrary scripts defined in the target repository, which is an inherent risk for autonomous coding agents.

afk-loop