The Agent Skills Directory

[PERSISTENCE]: The skill explicitly instructs the agent to implement a "wake mechanism" using background subagents or fixed-interval heartbeats to ensure operations continue "unattended" or "while the user is away."
[COMMAND_EXECUTION]: The agent is directed to define and execute arbitrary commands or artifacts to verify "exit predicates," such as running tests or checking pixel differences (SKILL.md).
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to instructions embedded in processed data.
Ingestion points: Untrusted data enters the agent context via CI output, pull request logs, and bot/reviewer comments encountered during iterations (SKILL.md).
Boundary markers: The instructions contain no delimiters or warnings to ignore instructions embedded within external data.
Capability inventory: The agent has the ability to create pull requests (gh pr create), modify files, call other agent skills, and execute shell commands for predicate verification (SKILL.md).
Sanitization: There is no requirement or logic for sanitizing or escaping external content before interpolation or action.
[PROMPT_INJECTION]: The skill includes instructions that encourage the agent to bypass standard interactive oversight, such as "You own the exit condition," "drive to it without stopping," and "Keep reversible work moving without asking the user."
[DYNAMIC_EXECUTION]: The agent is instructed to "Fix what you find along the way yourself," including fixing "broken skills" by calling development tools, which involves runtime modification of executable logic.

autonomous-run