The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The workflows configured by this skill (e.g., scheduled triage, PR resolution, and issue implementation) are designed to ingest and process untrusted external data, creating a potential surface for indirect prompt injection.
Ingestion points: The agent is instructed to read external content like GitHub issue descriptions, PR comments, and project files (e.g., package.json, pyproject.toml) as specified in SKILL.md and various files in the recipes/ directory.
Boundary markers: The setup process does not explicitly define or implement delimiters or instructions to ignore embedded commands within the external data being processed.
Capability inventory: The resulting agent loops are granted the capability to execute shell commands (verifiers) and modify repository files (e.g., CLAUDE.md, .agent/context/) as defined in SKILL.md and loops-template.md.
Sanitization: No explicit sanitization, validation, or filtering of external input is performed or recommended during the setup phase.
[DYNAMIC_EXECUTION]: The skill generates configuration files containing shell commands (e.g., test runners and linters) that the agent is intended to execute during autonomous iterations.
Evidence: loops-template.md provides templates for commands like npm test or npm run typecheck, and SKILL.md guides the agent to detect, propose, and write these commands to .agent/context/loops.md for subsequent runtime execution. This is a core functionality of the skill using standard templates.

setup-agent-loops