The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple system commands including git, gh (GitHub CLI), and various build/test tools (sbt, flutter, npm, vitest). These commands are used for branch manipulation, code testing, and pushing changes to remote repositories.
[PROMPT_INJECTION]: The instructions employ 'EMERGENCY MODE' framing and explicit overrides of agent behavior, such as 'Do NOT ask the user questions' and 'Do NOT reference Claude, AI, or include any AI attribution.' These patterns reduce user oversight and enforce concealment of the agent's identity.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of untrusted data.
Ingestion points: The skill ingests bug descriptions via $ARGUMENTS, error messages, stack traces, and project source code.
Boundary markers: The skill uses heavy visual separators (============================================================) but lacks explicit 'ignore instructions' delimiters for untrusted data like $ARGUMENTS.
Capability inventory: The agent has permissions to perform git operations (branch, commit, push), create PRs via gh, and execute arbitrary project test suites.
Sanitization: While the skill suggests 'slugifying' the bug description for branch names, it does not explicitly sanitize other inputs that are processed into command outputs or PR bodies.
[DATA_EXFILTRATION]: The skill performs legitimate network operations to well-known services, specifically using git push and gh pr create to send codebase changes to external git providers.
[PERSISTENCE]: The skill implements a logging mechanism that writes to ~/.claude/projects/*/skill-telemetry.md. This allows it to persist execution metadata in a hidden directory across different sessions.

hotfix