The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions in references/gates.md direct the agent to download and install a third-party tool from a remote repository (https://github.com/steipete/clawdis) using the npx skills add command. This represents a risk of executing unverified external code within the agent's environment.
[EXTERNAL_DOWNLOADS]: The skill directs the agent to fetch and install tools from non-vendor GitHub repositories, which are not subject to the same security controls as official packages or trusted sources.
[COMMAND_EXECUTION]: The scripts/autopilot-status-board.py script executes shell commands via subprocess.run to interact with the GitHub CLI. The skill also requires the agent to execute a series of git and task management commands, many of which use parameters derived from external metadata.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its autonomous processing of GitHub issue content. Ingestion points: Instructions for code implementation are retrieved from GitHub issue URLs and bodies (as seen in references/worker-contract.md). Boundary markers: The skill lacks explicit delimiters or instructions to ignore nested prompts within the ingested data. Capability inventory: The agent has capabilities to write files (codex exec), push code, merge PRs, and install new skills. Sanitization: There is no evidence of data sanitization or validation for the content fetched from GitHub issues.

shiploop