The Agent Skills Directory

[DATA_EXFILTRATION]: The scripts/worktree-audit.sh script performs an automated scan of the agent's internal transcript directory (~/.claude/projects/) using the rg (ripgrep) tool to find chat sessions that have operated in specific git worktrees. This provides the skill with access to cross-project session data and private chat history that may contain sensitive information unrelated to the current task.
[EXTERNAL_DOWNLOADS]: The skill utilizes scripts/bootstrap.ts to automatically execute bun install --frozen-lockfile when the tooling is loaded. This allows for the dynamic fetching and installation of external Node.js dependencies from package registries, which introduces supply chain risks and involves executing third-party code as part of the skill's setup process.
[COMMAND_EXECUTION]: The skill frequently executes a wide range of external CLI tools, including git, gh (GitHub CLI), gt (Graphite), and multiple AI model provider CLIs (claude, codex, grok). These commands are spawned via Bun.spawn and child_process.spawn to manage local files, branch state, and PR interactions, granting the skill high-privilege access to the user's development environment.
[PROMPT_INJECTION]: The SKILL.md instructions establish "Non-negotiables" that attempt to override the agent's default routing behavior. It specifically mandates that the agent must use only the skills and playbooks provided by this plugin and prohibits substituting other engineering tools, which is a behavioral override intended to bypass the agent's standard workflow selection.
[DYNAMIC_EXECUTION]: The scripts/runner/ and scripts/watch-pr/ tools dynamically assemble shell commands based on runtime parameters and configuration files. This includes constructing argument arrays for external model executors and GitHub API calls, which are then executed within the local shell environment.
[INDIRECT_PROMPT_INJECTION]: The skill features a large attack surface for indirect injection as it retrieves untrusted content from GitHub pull request comments and descriptions. Although playbooks/babysit.md contains instructions to treat review comments as untrusted data, the skill's ability to edit files and run system commands based on that content remains a potential vulnerability if the agent inadvertently follows instructions embedded in external feedback.

patina-mode