The Agent Skills Directory

[DATA_EXPOSURE]:
Evidence: The skill reads and manages the ~/.agentloop-fleet/env file to scaffold environment variables and credentials, specifically deriving the GH_TOKEN from the local GitHub CLI session.
Context: Access is restricted to the local environment, and the installer explicitly sets file permissions to mode 600 (owner-only access) and refuses to overwrite existing credential files, aligning with security best practices for local secret management.
[PERSISTENCE_MECHANISMS]:
Evidence: The skill modifies the user's crontab to install a marker-block (# agentloop-fleet:begin/end) that executes scheduled agent tasks.
Context: This behavior is the primary intended function of the skill (fleet scheduling) and is performed within a well-defined block to prevent interference with other system tasks.
[COMMAND_EXECUTION]:
Evidence: The skill executes shell commands to collect environment facts and runs a local script (fleet/setup.ts) using the bun runtime for installation.
Context: The executed scripts are part of the local plugin repository provided by the vendor, and command execution is used solely for deployment and configuration reconciliation.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The routines created by this skill ingest untrusted data from GitHub repositories, specifically issues and pull requests, to perform automated sweeps (e.g., issue-sweep, pr-sweep).
Boundary markers: The skill documentation mentions the use of local promptDir wrappers, but does not specify explicit delimiters or "ignore instructions" warnings for the external content processed by the autonomous routines.
Capability inventory: The scheduled routines are granted access to high-privilege tools including Bash, Read, Glob, Grep, and the Skill execution tool.
Sanitization: Not explicitly implemented within this setup skill; sanitization and filtering are delegated to the underlying routine prompt logic.

fleet-setup