The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is explicitly instructed to follow and prioritize 'policies' embedded in HTML comments (e.g., ) and metadata fields within the TASKS.md file it processes.
Ingestion points: TASKS.md (policies, task details, and acceptance criteria).
Boundary markers: None. The skill instructions state that these policies take precedence over task instructions.
Capability inventory: The agent has access to file system modification, shell execution (Bash), and network operations via git and the GitHub CLI (gh).
Sanitization: No sanitization or validation of the embedded instructions is performed before adoption.
[COMMAND_EXECUTION]: The skill performs an automated execution of a local script (node scripts/check-zero-ship-streak.mjs) during its pre-flight check. This allows any repository the agent interacts with to execute arbitrary code with the agent's privileges if that file exists.
[COMMAND_EXECUTION]: The skill implements a cross-repository roaming feature that scans all subdirectories in ~/apps/ to find and process TASKS.md files, expanding the agent's reach beyond its initial working directory.

next-task