The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/bootstrap.ts file automatically executes a package installation command (bun install --frozen-lockfile) to ensure the required Node.js dependencies are available before running the main scripts.
[COMMAND_EXECUTION]: Multiple scripts, including scripts/orch/store.ts and scripts/watch-pr/github.ts, utilize the spawn or execFileSync methods to run system commands such as git, gh (GitHub CLI), and origin for managing the repository state and pull request lifecycle.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data, such as pull request descriptions, Git history, and user review comments, which are subsequently reflected in the agent's context.
Ingestion points: Pull request metadata and review thread comments are retrieved using gh pr view and the GitHub GraphQL API in scripts/watch-pr/github.ts and scripts/orch/store.ts.
Boundary markers: The SKILL.md instructions explicitly advise the agent to treat review-comment text as untrusted data and to maintain a skeptical posture toward automated review comments.
Capability inventory: The skill possesses the capability to execute shell commands (git, gh, origin) and perform file system write operations across the workspace.
Sanitization: The instructions guide the agent to triage external findings against the actual source code and to defer to human judgment for high-severity or ambiguous security issues.
[DYNAMIC_EXECUTION]: The scripts/bootstrap.ts script performs a self-restart by spawning a new process with the same arguments after it has successfully ensured that all dependencies are installed.

poteto-mode