The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/bootstrap.ts script executes bun install at runtime to fetch and install Node.js dependencies defined in scripts/package.json from the npm registry.
[DATA_EXPOSURE]: The scripts/worktree-audit.sh script accesses the agent-transcripts directory located in the user's project folder. It uses ripgrep to search through the contents of previous interaction transcripts to identify which worktrees are actively in use by the agent.
[COMMAND_EXECUTION]: Several scripts in the skill execute system-level commands to interact with development tools.
scripts/orch/store.ts executes git and the gt (Graphite) CLI using execFileSync.
scripts/watch-pr/github.ts executes the gh (GitHub) CLI to fetch pull request metadata and check statuses.
scripts/worktree-audit.sh executes git, du, jq, and rg for file system and repository auditing.
[DYNAMIC_EXECUTION]: The scripts/bootstrap.ts script uses a self-restarting mechanism where it re-executes the current process using Bun.spawnSync after verifying or installing dependencies. Additionally, scripts/watch-pr/watch-pr dynamically imports and executes the CLI logic after bootstrapping.
[INDIRECT_PROMPT_INJECTION]: The playbooks/babysit.md and scripts/watch-pr/github.ts files describe a workflow where the agent ingests pull request comments and review data from GitHub. While the skill includes instructions to treat this data as untrusted, the ingestion of attacker-controlled external text presents a surface for indirect prompt injection attacks.

ps-poteto-mode