The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/cleanup.py script automatically executes a script file discovered at runtime within the managed repository. Evidence: The script defines REPOSITORY_HOOK = ".agents/hooks/cleanup" and executes it in repository_hook using subprocess.run([str(hook)], cwd=primary, allowed=(0, 1)). This allows any repository the agent works on to execute arbitrary code.
[COMMAND_EXECUTION]: The skill relies on executing git and gh shell commands via subprocess.run in start.py, delivery.py, and cleanup.py. Spawning subprocesses based on external repository state and data increases the vulnerability to command injection if arguments are not strictly controlled.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the ingestion of untrusted data from GitHub. 1. Ingestion points: Issue metadata and sub-issue lists in scripts/start.py, and pull request review thread comments in scripts/delivery.py. 2. Boundary markers: No delimiters or protective instructions are used when handling these external strings. 3. Capability inventory: The skill can execute shell commands, manage files, and run local repository hooks. 4. Sanitization: While subprocess.run uses list-based arguments, there is no validation or sanitization of the text content retrieved from GitHub.

implement