The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its session inheritance mechanisms.
Ingestion points: The agent is instructed to locate and read files within the agent-transcripts/ directory in the active workspace in playbooks/session-pickup.md and playbooks/eval.md to reconstruct operational state.
Boundary markers: There are no explicit delimiters or instructions to ignore or sanitize embedded commands within the inherited transcripts; the agent is simply told to "resist the bias to re-derive" and treat the prior trail as "authoritative input."
Capability inventory: The skill allows for file system writes, git operations (including force-pushes), and the use of external tools like the GitHub CLI (gh) and UI/CLI control plugins.
Sanitization: No sanitization or validation of the transcript content is mentioned before the agent adopts the previous state.
[PROMPT_INJECTION]: The skill defines "Session overrides" that instruct the agent to ignore standard pauses or user interaction requirements when specific phrases like "going to bed" or "run until done" are used. This encourages autonomous behavior that may bypass typical safety checkpoints.
[COMMAND_EXECUTION]: The skill prescribes high-capability commands for debugging and development. The playbooks/runtime-forensics.md file instructs the agent to "Inject instrumentation via CDP eval on the running process, or hotfix the live code without reloading," which involves runtime execution of generated code. Additionally, the Opening a PR playbook utilizes the GitHub CLI (gh) and git commands to manage remote repositories.

poteto-mode