The Agent Skills Directory

[DYNAMIC_EXECUTION]: The ship-pr.mjs script contains a runDeployCheck function that executes an arbitrary command specified in the deployCheck field of the project's configuration file (e.g., .github/ship-pr.json). This allows a repository being managed by the tool to define arbitrary shell commands that will be executed by the agent during the automated shipping process.
[COMMAND_EXECUTION]: The audit-detect.mjs script includes a runVerify function that executes arbitrary shell commands provided via the --verify command-line argument using spawnSync with shell: true. This provides a direct mechanism for unrestricted shell execution within the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to audit and respond to the content of a repository, which is inherently untrusted. It reads documentation files, CI configurations, and pull request metadata to drive its logic.
Ingestion points: Documentation files (AGENTS.md, CLAUDE.md, .cursorrules), CI configuration files (.github/workflows/*.yml), and pull request state (including titles, bodies, and review threads) retrieved via the GitHub API.
Boundary markers: The scripts do not use explicit delimiters or "ignore embedded instructions" warnings when processing or interpolating repository data.
Capability inventory: The tool has the ability to execute shell commands (execFileSync, spawnSync), perform filesystem writes, and manage repository settings via the gh CLI.
Sanitization: External content from files and PR comments is processed without robust sanitization before being used to determine the tool's next actions or included in reports.
[EXTERNAL_DOWNLOADS]: The skill's instructions recommend the use of npx kcd-skills@latest, which downloads and executes code from the npm registry. While this package is associated with the skill's author, the use of the @latest tag is a practice that can introduce supply chain risks if the remote package were to be compromised.

autopilot