The Agent Skills Directory

[COMMAND_EXECUTION]: The skill explicitly instructs the agent to "Reproduce the symptom through the recorded command" found in follow-up markdown files. This allows the execution of arbitrary shell commands stored in the repository, which is a high-risk capability if the content of those files is untrusted or comes from an unverified source.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. Because the agent follows instructions (commands and proposed steps) provided in docs/follow-ups/*.md files, a malicious actor could craft a follow-up file that tricks the agent into executing exfiltration commands, modifying sensitive configuration, or overriding its safety guidelines during the automated reproduction process.
Ingestion points: docs/follow-ups/*.md (specifically fields like Observed evidence, What was tried, and Proposed next step).
Boundary markers: None. The instructions do not include delimiters or specific warnings to ignore embedded directives in the follow-up files.
Capability inventory: The agent has access to the shell, Git tools, and file system within the worktree isolation.
Sanitization: The skill does not perform any validation or sanitization of the commands extracted from the markdown files before execution.

resolve-follow-ups