The Agent Skills Directory

[PROMPT_INJECTION]: The skill provides instructions that explicitly direct the agent to override standard safety guardrails by operating in a "non-interactive automation mode" and to "execute tasks from start to finish without seeking approval for each action."
[COMMAND_EXECUTION]: The skill documents and encourages the use of the bypassPermissions and acceptEdits modes, which skip human-in-the-loop permission prompts for shell commands and file modifications. While the skill includes a warning to use these in sandboxed environments, it reduces the safety margin for the agent.
[EXTERNAL_DOWNLOADS]: The skill instructs the installation of the @anthropic-ai/claude-code package from the official registry, which is an expected dependency for the stated purpose of the skill.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, such as pull request diffs and codebase content, while maintaining high-privilege capabilities including shell command execution and file writes. This combination creates a vulnerability surface where malicious data could influence agent actions.
Ingestion points: Reads files and pull request diffs via the claude CLI and gh tools.
Boundary markers: The provided instructions do not specify the use of clear delimiters or instructions for the agent to ignore embedded commands in the processed data.
Capability inventory: The skill utilizes Bash, Read, Write, and Edit tools, as well as various MCP-based integrations.
Sanitization: There is no evidence of sanitization or validation of the external content before it is processed by the agent.

claude-skill