The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external contributors, including pull request bodies and the content of suggested skill trees, which can contain malicious instructions intended to influence the agent's behavior during triage or release.
Ingestion points: The skill reads PR metadata, body text, and the full directory structure of proposed changes (skills/<skill-id>/**) as described in SKILL.md and references/maintenance-cycle.md.
Boundary markers: The skill defines explicit boundaries for parsing template comments in references/contribution-intake.md, instructing the agent to parse them as bounded text spans and ignore unfinished comments.
Capability inventory: The skill possesses extensive capabilities including execution of repository scripts (npm run), performing git merges, and publishing packages to npm.
Sanitization: Instructions in references/contribution-intake.md specify that reports should sanitize untrusted paths and reasons.
[COMMAND_EXECUTION]: The skill utilizes a wide array of local shell commands via npm scripts to manage the repository lifecycle, including building, testing, and merging code.
Evidence: Commands such as npm run maintenance:cycle, npm run merge:batch, and npm run release:prepare are used throughout SKILL.md and its references to perform maintenance tasks.
[EXTERNAL_DOWNLOADS]: The skill references the installation of external maintenance and scanning tools from established vendors.
Evidence: references/skillspector.md describes the installation of NVIDIA SkillSpector v2.12.0 pinned to a specific immutable commit (c7958a3268d9498644b22edb75d0f051bbc8cbfc) using the uv tool.

antigravity-maintainer-batch-release