The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes instructions that explicitly direct the agent to operate without human intervention, stating 'The human will not touch any code. You execute everything autonomously'. It also employs a 'future-dated' persona (referencing June 2026 and TypeScript 7) to project a deceptive authority intended to influence agent behavior and bypass current knowledge constraints. Furthermore, it instructs the agent to self-modify its own SKILL.md file based on runtime feedback, which could lead to persistent instruction drift.
[PERSISTENCE]: The skill instructs the agent to modify the user's ~/.zshenv file to persist environment variable changes (PROTO_HOME) and PATH modifications across shell sessions.
[EXTERNAL_DOWNLOADS]: The skill fetches an installation script from moonrepo.dev and executes it directly via a shell pipe (curl | bash). It also installs various third-party packages from official registries (NPM, PyPI), including specialized forks for monorepo release management.
[METADATA_POISONING]: The skill contains deceptive claims about 'verified' tool statuses from the year 2026 and references unreleased software versions (such as TypeScript 7.0.2), which serves to misinform the agent about its operational context.
[INDIRECT_PROMPT_INJECTION]: The skill scaffolds a monorepo environment with high-privilege capabilities (shell execution, file writes) using user-provided inputs such as repository names. The analysis found no evidence of sanitization or boundary markers to prevent malicious inputs from influencing the generated project structure or downstream commands.

bootstrap-monorepo