The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted external data and has high-privilege capabilities.
Ingestion points: External links provided by users are processed in Phase 2 (YouTube transcripts via the transcribe:transcribe skill, web articles, and GitHub repositories).
Boundary markers: The instructions lack explicit delimiters or warnings to the agent to ignore instructions embedded within the processed research materials.
Capability inventory: The skill has significant capabilities across its scripts, including shell command execution (bash), Git operations (commit, push), and GitHub CLI interactions (PR creation and automated merging).
Sanitization: There is no evidence of sanitization or filtering of external content before it is processed by the agent or referenced in project comparisons.
[COMMAND_EXECUTION]: The skill uses shell commands to manage configuration and automate development workflows. While these are standard for development tools, the execution of these commands based on logic influenced by external research data represents an elevated capability tier.
Evidence: SKILL.md contains multiple bash execution blocks in Phase 0.0 (context loading), Phase 0.2 (pulling repos), and Phase 10 (Git branch management, pushing, and PR handling via the gh tool).
[EXTERNAL_DOWNLOADS]: The skill naturally performs network operations to fetch research materials and interact with GitHub APIs.
Evidence: Interaction with external URLs via the transcribe skill and standard Git/GitHub CLI operations.

deep-dive