The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions that explicitly direct the agent to override standard interactive safety protocols and operational constraints. Phrases such as "NEVER STOP" and "do NOT pause to ask the human if you should continue" are used to suppress human-in-the-loop verification during high-impact tasks.
[INDIRECT_PROMPT_INJECTION]: The skill operates by autonomously scanning and acting upon codebase content, which creates a significant attack surface for indirect prompt injection.
Ingestion points: The agent reads project-level metadata (e.g., package.json, Cargo.toml) and scans all source files for patterns across the repository.
Boundary markers: The instructions lack delimiters or warnings to ignore potentially malicious instructions embedded within the codebase data being processed.
Capability inventory: The skill uses high-impact tools including Bash, Edit, Write, and Agent.
Sanitization: There is no evidence of content sanitization or validation of the data ingested from the repository.
[COMMAND_EXECUTION]: The skill workflow relies on executing shell commands via the Bash tool for running tests, timing operations, and managing git branches. When combined with the lack of human oversight, this increases the risk of the agent executing unintended or malicious commands if influenced by repository content.

sherlock