The Agent Skills Directory

[PROMPT_INJECTION]: The skill proactively addresses prompt injection by instructing the agent to treat all external data (flag keys, names, descriptions, and repository content) as literal data, never as instructions. It specifically warns that a flag named 'ignore previous instructions' should be treated only as a badly named flag.
[COMMAND_EXECUTION]: The skill uses shell commands for Git operations (git status, git log, git fetch) and GitHub CLI (gh pr list, gh pr diff). Security is maintained by strictly validating and quoting arguments. Branch names and refs are only interpolated if they match a safe regex pattern (^[A-Za-z0-9_./-]+$) to prevent command injection via malicious branch naming.
[INDIRECT_PROMPT_INJECTION]: The skill identifies a surface for indirect injection since it processes external repository content and PostHog API data. It mitigates this by requiring the agent to perform multiple 'four-read' checks (definition, status, dependents, schedules) at different stages of the workflow (assessment, pre-edit, and pre-publish) to ensure the state hasn't been maliciously altered. It also uses shell-level filtering (grep) to prevent hunks of code from reaching the LLM's context during PR reviews.
[DATA_EXFILTRATION]: The skill explicitly forbids including sensitive information such as usage counts, customer data, or secrets in public-facing PR descriptions or commit messages. It limits the shared context to the minimal metadata required for code cleanup.
[PRIVILEGE_ESCALATION]: The skill adheres to the host's review, commit, and PR policies, ensuring it does not bypass established security controls for repository writes.

cleaning-up-stale-feature-flags