The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection where data from external repositories can influence agent behavior.
Ingestion points: Pull Request metadata (titles, branches) fetched via gh pr list and configuration instructions from CLAUDE.md files (Stage 01 CONTEXT.md).
Boundary markers: Absent; untrusted data is interpolated directly into prompt strings (e.g., <package> and <files> in Stage 05 CONTEXT.md) without protective delimiters or instructions to ignore embedded commands.
Capability inventory: The skill has significant capabilities including executing arbitrary commands on worker devboxes via pylot workers prompt, merging pull requests via gh pr merge, and creating GitHub issues via gh issue create (Stage 02 CONTEXT.md).
Sanitization: No explicit sanitization, escaping, or validation of the ingested repository content is performed before interpolation into sub-agent prompts.
[COMMAND_EXECUTION]: The skill makes extensive use of system commands including gh (GitHub CLI) for repository interaction and pylot for worker lifecycle management and task execution. This behavior is expected given the skill's purpose as an operations pipeline.
[EXTERNAL_DOWNLOADS]: Triggers the installation of project dependencies via npm install and bundle install within the worker devbox environment (Stage 04 CONTEXT.md). These operations are standard for dependency verification tasks.
[DYNAMIC_EXECUTION]: Utilizes inline Python scripts (python3 -c) for parsing JSON responses from CLI tools and reading YAML configuration files (e.g., Stage 01 and Stage 05). These are used for internal logic and data processing rather than executing untrusted input.

deps-runner