The Agent Skills Directory

[COMMAND_EXECUTION]: The skill autonomously identifies and executes shell commands from repository configuration files, such as package.json, Makefile, and pyproject.toml, to run test suites. In 'auto mode', these commands are executed without human review or confirmation, which poses a significant risk if the repository contains malicious or compromised build scripts.
[DATA_EXFILTRATION]: Autopilot is authorized to read any file within the repository and can autonomously push branches and create pull requests via the gh CLI. This functionality creates a potential pathway for the exfiltration of sensitive information, such as .env files or hardcoded secrets, if they are inadvertently included in the agent's autonomous code changes or PR descriptions.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from the local repository (code, documentation, and git logs) to drive its orientation, planning, and implementation phases. Without human-in-the-loop validation, malicious instructions placed in the codebase could manipulate the agent's autonomous actions.
Ingestion points: Reads all repository files, documentation, and git history to establish context and build implementation specs (SKILL.md).
Boundary markers: No specific delimiters or 'ignore instructions' warnings are mentioned for handling ingested repository content.
Capability inventory: The skill can execute arbitrary shell commands for testing, perform filesystem writes, and interact with external GitHub repositories through the gh CLI (SKILL.md).
Sanitization: The analysis found no evidence of sanitization or filtering of external repository content before it is processed by the agent.

autopilot