The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses nohup bash -c and disown to launch background processes, specifically the claude CLI, to handle parallel pull request workflows. The claude CLI is invoked with the --permission-mode bypassPermissions flag, granting the background agent full autonomy to execute tools, including shell commands and file modifications, without user approval.\n- [PROMPT_INJECTION]: The skill exhibits an Indirect Prompt Injection surface by instructing agents to read and react to pull request descriptions, review comments, and body text from GitHub.\n
Ingestion points: Pull request metadata and review comments retrieved from GitHub (Phase 1, Phase 6, and references/verification-gates.md).\n
Boundary markers: The lane prompt template provides isolation instructions but lacks explicit directives to ignore or treat embedded instructions in PR data as untrusted.\n
Capability inventory: The background agents have unrestricted access to local system tools and the GitHub CLI via the bypassPermissions flag.\n
Sanitization: No sanitization or filtering is applied to the external content before the agent processes it.\n- [REMOTE_CODE_EXECUTION]: The combination of automated background execution with full tool permissions and the ingestion of untrusted external content allows for potential remote code execution triggered by third-party GitHub users.\n- [EXTERNAL_DOWNLOADS]: The skill executes standard package management commands (npm, yarn, bun) and build scripts within isolated worktrees, which involves fetching third-party code from well-known registries. These are standard operations for development workflows.

pr-swarm