The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill generates dynamic instructions by writing implementation prompts to a file (.milestone-prompt.md) in a worktree and subsequently executing them using a sub-session. This pattern of script generation and runtime execution of dynamically created content is a known vector for instruction manipulation.
[COMMAND_EXECUTION]: The runner invokes shell commands that specifically utilize the --permission-mode bypassPermissions flag. This command-line argument is used to suppress standard platform security prompts, granting the sub-session elevated autonomy to perform file and system operations without interactive user consent.
[PRIVILEGE_ESCALATION]: The explicit use of bypass flags in the implementation phase allows the subagent to operate with fewer restrictions than the parent agent, effectively escalating its effective permissions within the environment.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a broad attack surface for indirect injection by reading and processing data from external, potentially untrusted sources such as repository files, pull request metadata, and CI logs.
Ingestion points: The skill reads .docs/DEVELOPMENT_PLAN.md, .docs/EXECUTION_PROMPTS.md, and retrieves PR bodies and CI evidence from external providers.
Boundary markers: While the skill contains instructions to treat this content as data rather than instructions, this is a soft constraint that may be bypassed if the ingested content contains adversarial prompts.
Capability inventory: The tool chain has the ability to execute shell commands (claude -p), perform Git operations (merge, rebase, branch cleanup), and modify repository files.
Sanitization: No explicit sanitization or strict schema validation is performed on the ingested data before it is interpolated into the context of implementing or verifying subagents.

milestone-runner