The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub PR review comments and local session transcripts to perform its primary functions.
Ingestion points: scripts/watch-pr/github.ts reads review threads from the GitHub API. scripts/worktree-audit.sh and playbooks/eval.md read session transcripts from ~/.claude/projects/ and ~/.codex/sessions/.
Boundary markers: The instructions in playbooks/babysit.md explicitly state to treat review-comment text as untrusted data and not as instructions. However, formal data delimiters are not used in the automated scripts.
Capability inventory: The skill has capabilities for file system access, shell command execution (via Task, Bun.spawnSync, and child_process.spawn), and network access via the gh CLI.
Sanitization: playbooks/babysit.md provides strong guidance to triage comments skeptically and avoid passing comment text directly into shells.
[EXTERNAL_DOWNLOADS]: The scripts/bootstrap.ts utility automatically runs bun install to fetch Node.js dependencies such as commander from the public registry during initialization.
[COMMAND_EXECUTION]: The skill makes extensive use of local shell commands to manage development workflows.
Evidence: scripts/watch-pr/github.ts executes gh (GitHub CLI) and git commands. scripts/orch/store.ts executes gt (Graphite CLI) and git commands. scripts/worktree-audit.sh is a bash script that performs Git operations and file system audits.
[DATA_EXFILTRATION]: The skill reads local session transcript files from ~/.claude/projects/ and ~/.codex/sessions/ to support session pickup and auditing features. While this data is used for the skill's primary purpose, it represents access to sensitive interaction history.
[DYNAMIC_EXECUTION]: The scripts/bootstrap.ts script uses Bun.spawnSync to re-execute the current process after ensuring dependencies are installed, effectively performing a self-restart with potentially updated environmental context.

poteto-mode