The Agent Skills Directory

[DATA_EXFILTRATION]: Access to local transcripts and configuration.\n
The skill accesses ~/.claude/projects/ to read JSONL transcript files (in playbooks/eval.md and playbooks/session-pickup.md). These transcripts contain private conversation history and potentially sensitive project data.\n
Instructions in references/codex-tools.md and playbooks/shipping.md detail how to read .env files and other credential-bearing paths (e.g., credentials.toml) in the user's home directory.\n- [COMMAND_EXECUTION]: Local script and CLI orchestration.\n
scripts/runner/pstack-runner is a wrapper used to execute various external binaries (claude, codex, grok, devin).\n
Several playbooks rely on running local TypeScript/Bun scripts (orch.ts, watch-pr, check-plan.mjs) to manage state and verify plans.\n
The shipping.md playbook utilizes the GitHub CLI (gh) for API-level repository mutations.\n- [EXTERNAL_DOWNLOADS]: Automated dependency management.\n
scripts/bootstrap.ts triggers bun install --frozen-lockfile if required Node.js dependencies are not found in the local node_modules directory.\n- [INDIRECT_PROMPT_INJECTION]: Vulnerability surface through untrusted data ingestion.\n
Ingestion points: Processes PR comments (playbooks/babysit.md), status reports from sub-agents (playbooks/orchestrate.md), and historical transcripts (playbooks/session-pickup.md).\n
Boundary markers: The babysit playbook includes a specific warning to treat external comments as untrusted data, although this pattern is not universally applied across all aggregation points.\n
Capability inventory: Possesses the ability to write files, execute shell commands, and merge pull requests.\n
Sanitization: Uses an environment allowlist in scripts/runner/run.ts to prevent unintentional secret leakage to child processes.

poteto-mode