The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically identifies and executes arbitrary shell commands and binaries found in the local environment, including project-specific test suites, linters, and formatters (e.g., eslint, ruff, cargo, go). This poses a risk if the project configuration or test scripts have been compromised.
[PROMPT_INJECTION]: The instructions 'Do NOT ask questions' and 'clean up everything aggressively' represent autonomy-focused directives that encourage the agent to override standard safety confirmations and human-in-the-loop checkpoints during destructive operations like file deletion.
[COMMAND_EXECUTION]: Phase 1 and Phase 2 involve automated file system modifications, including the deletion of 'dead code' and 'orphaned files' based on heuristic analysis of imports and git history. Such automated deletions can lead to significant data loss if the analysis incorrectly identifies active code as dead.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection as it parses untrusted data from the codebase, specifically 'TODO', 'FIXME', and 'HACK' comments. These comments could be used by an attacker to embed instructions that the agent might follow due to its autonomous operating mode.
Ingestion points: Reads all source files, comments, and project metadata (SKILL.md).
Boundary markers: None identified; untrusted code comments are processed directly.
Capability inventory: File deletion, code modification, shell command execution (tests/linters), and telemetry logging.
Sanitization: No sanitization or validation of the content of code comments is performed before processing.

cleanup-sprint