The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple arbitrary shell commands defined in the repository's .claude/routines/catalog.json file. This includes fields such as local.command, presenceRegister, envSetupScript, and singletonProbe. It also modifies the system crontab to create durable persistence for these commands by writing a marker block to the user's crontab file.
[CREDENTIALS_UNSAFE]: The instructions direct the agent to extract sensitive credentials, specifically CLAUDE_CODE_OAUTH_TOKEN and GH_TOKEN (extracted via gh auth token), and store them in a persistent local file at ~/.<slug>-routines/env. While it specifies mode 600, storing plaintext tokens in a file for automated access is a significant security risk.
[REMOTE_CODE_EXECUTION]: The skill executes repository-provided installation commands and runs scripts within a dedicated worktree or clone. This allows the repository to execute arbitrary code on the runner's machine during the setup phase or during scheduled routine execution.
[DATA_EXFILTRATION]: The skill uses the RemoteTrigger tool to create cloud-based automation that sends rendered prompt templates and repository data to an external platform. This effectively schedules the transmission of repository contents to a remote service.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of untrusted repository data.
Ingestion points: Reads configuration and prompt templates from .claude/routines/catalog.json and .claude/routines/templates/*.md.
Boundary markers: No delimiters or safety instructions are used to separate ingested template content from agent instructions during interpolation.
Capability inventory: The skill possesses extensive capabilities including shell execution (Bash), file system modification, and cloud trigger management (RemoteTrigger).
Sanitization: There is no evidence of sanitization, validation, or filtering of the ingested repository content before it is executed as a command or rendered into cloud triggers.

setup-routines