The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the agent to operate with high autonomy using directives like "Just do it," "Never block on the human," and "Decide a call... with no reply word and no offer." These instructions are designed to reduce user oversight. Furthermore, "Session overrides" (e.g., "going to bed," "run until done") explicitly allow the agent to bypass standard safety pauses for irreversible writes such as data deletion or force-pushes.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect injection as it is designed to ingest and act upon untrusted data from bug reports and automated review bot comments.
Ingestion points: Untrusted data enters the context via playbooks/bug-fix.md (reported defects) and references/review-bot-triage.md (automated bot comments).
Boundary markers: The skill does not define explicit delimiters or warnings to ignore instructions embedded in the processed data.
Capability inventory: The agent has access to powerful tools including subagent creation (create_agent), repository management (git), and pull request operations (gh CLI).
Sanitization: There is no evidence of sanitization or filtering logic to prevent external data from influencing the agent's behavior.
[COMMAND_EXECUTION]: The skill makes extensive use of system commands for development workflows, specifically targeting git for worktree and branch management, and the GitHub CLI (gh) for managing the lifecycle of pull requests.

poteto-mode