The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's toolset involves external dependency management. Specifically, scripts/bootstrap.ts automatically runs bun install --frozen-lockfile to install dependencies defined in scripts/package.json, which includes commander@15.0.0 from the NPM registry.
[INDIRECT_PROMPT_INJECTION]: The watch-pr tool in scripts/watch-pr/github.ts ingests untrusted data by fetching GitHub PR review threads and comments. This presents an attack surface where external users could embed malicious instructions in PR comments. The skill attempts to mitigate this in playbooks/babysit.md by instructing the agent to treat comment text as untrusted data and not as instructions.
[COMMAND_EXECUTION]: Multiple scripts and playbooks execute system commands. scripts/watch-pr/github.ts and scripts/orch/store.ts use spawn and execFileSync to run git, gh (GitHub CLI), and gt (Graphite CLI). scripts/worktree-audit.sh uses du, jq, and rg to audit disk usage and git states.
[DATA_EXPOSURE]: The scripts/worktree-audit.sh script accesses the agent's internal transcript directory at ~/.claude/projects/ to correlate worktrees with recent user sessions. While this data is local, it involves scanning session history files.
[DYNAMIC_EXECUTION]: The scripts/bootstrap.ts utility performs a self-reinvocation pattern using Bun.spawnSync to restart the process with newly installed dependencies.

patina-mode