The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructs the agent to execute PowerShell with the -ExecutionPolicy Bypass flag in SKILL.md to run the fetch-upstream-delta.ps1 script. This flag is explicitly designed to circumvent local security policies that restrict script execution.
[REMOTE_CODE_EXECUTION]: The skill clones an external repository (github.com/everyinc/compound-engineering-plugin) and incorporates its scripts and instructions into the local project. This creates a supply chain risk where malicious changes in the upstream repository could be integrated into the local environment and subsequently executed.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes markdown and code files from an external repository, creating an attack surface for indirect prompt injection where instructions in the source files could override agent behavior during the porting process.
Ingestion points: The fetch-upstream-delta scripts clone a remote repository to a temporary path (UPSTREAM_ROOT) from which the agent reads files.
Boundary markers: The skill does not provide explicit delimiters or instructions to the agent to treat the ported content as data rather than instructions, relying instead on a 'semantic merge' process.
Capability inventory: The agent has permissions to write files to the local repository, execute shell commands, and manage GitHub issues using the gh CLI.
Sanitization: The skill performs branding-related text transformations but lacks validation or sanitization for malicious logic or embedded instructions in the imported content.
[COMMAND_EXECUTION]: The skill uses the GitHub CLI (gh) to interact with repository issues for configuration storage. These tools are not listed in the allowed-tools frontmatter, indicating a potential attempt to use restricted tools or an inconsistency in the skill's security configuration.
[EXTERNAL_DOWNLOADS]: The skill performs automated clones of a remote repository from GitHub (everyinc/compound-engineering-plugin). While GitHub is a well-known service, the specific organization is not a pre-verified trusted source.
[DATA_EXFILTRATION]: The skill reads project configuration and sync baselines from a GitHub issue and writes updated sync points back to the remote repository. This use of GitHub issues as a 'config storage' mechanism moves local state to a remote platform.

sync-ups