The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently executes local commands using node, bun, git, and the GitHub CLI (gh). These tools are used for project-related tasks such as auditing git worktrees, managing dependencies, and interacting with GitHub for Pull Request status monitoring and merging. The skill uses array-based spawn methods and avoids direct shell interpolation of untrusted data, which follows safe command execution practices.
[EXTERNAL_DOWNLOADS]: A bootstrap script (scripts/bootstrap.ts) automatically invokes bun install to ensure necessary Node.js dependencies (commander, typescript, bun-types) are present in the environment. These packages are fetched from the official registry during initialization and are used exclusively for supporting the skill's utility scripts.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, specifically GitHub Pull Request titles, descriptions, and user/bot comments. To mitigate the risk of indirect prompt injection, the skill's playbooks (such as playbooks/babysit.md and references/bugbot-triage.md) explicitly instruct the agent to triage this data skeptically, treat it as untrusted input, and never interpret it as direct instructions or commands.

poteto-mode