The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes user-supplied briefs and external content from --skill-url arguments which could contain malicious instructions designed to influence agent behavior (Indirect Prompt Injection).
Ingestion points: Task brief variable {brief} and external skill URLs provided via the --skill-url argument in SKILL.md.
Boundary markers: The skill explicitly instructs the agent to treat external skills as "reference material" only and specifies that they must not override local project rules or agent instructions.
Capability inventory: Perform git operations (worktree, commit, push), interact with the GitHub CLI, install packages based on local lockfiles, and execute arbitrary commands defined in the project's .ai/agentic.config.json (SKILL.md).
Sanitization: The skill mandates that the agent ignore any instructions to skip tests, bypass security hooks, or exfiltrate data, and requires flagging such attempts in the plan's Risks section.
[COMMAND_EXECUTION]: The skill performs extensive shell operations including git worktree management, commit creation, and interaction with the GitHub CLI. It also executes validation.commands specified in the local .ai/agentic.config.json configuration file as part of its automated workflow.
[EXTERNAL_DOWNLOADS]: The skill fetches external content from user-provided URLs specified in the --skill-url argument. It treats this content as non-authoritative and includes explicit logic to prioritize local security policies and project rules over instructions found in these remote files.

auto-create-pr