The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/package.json and scripts/bun.lock files specify Node.js dependencies with version numbers that significantly exceed current official releases (e.g., typescript@7.0.2, commander@14.0.0, @types/node@26.1.2). This is a strong indicator of dependency poisoning or version squatting, where malicious packages are published to public registries using inflated version numbers to trick package managers into installing them over legitimate versions.
[COMMAND_EXECUTION]: The skill's bootstrap process (scripts/bootstrap.ts) automatically executes bun install --frozen-lockfile, which would trigger the download and potential execution of these suspicious dependencies. Furthermore, the skill's reliance on the tsc binary for type-checking provides a direct execution path for code contained within the spoofed typescript package.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection as it is designed to ingest and process external data from GitHub, such as pull request comments and review threads. While it includes internal warnings to treat this data as untrusted, the skill's high degree of autonomy and extensive system capabilities (including transcript access and shell execution) make it vulnerable to manipulation by external contributors.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands (e.g., git, gh, du, rg, xcrun) across multiple scripts and playbooks. The complexity of these automated workflows increases the risk of unintended side effects or exploitation if any part of the command-chain is compromised by the suspicious dependencies or external input.

poteto-mode