The Agent Skills Directory

[PROMPT_INJECTION]: The skill explicitly instructs the agent to bypass user confirmation, stating 'Resume orchestration immediately
do not wait for user input' and requiring the agent to 'Always operate under autonomous-operation mode.' These instructions attempt to override the agent's safety protocols regarding user oversight.
[REMOTE_CODE_EXECUTION]: The skill is designed to automatically execute a local script (scripts/init.sh) and trigger package managers (pnpm install, pip install) when bootstrapping the environment. This represents a risk of executing arbitrary code if the repository contains malicious configuration files.
[COMMAND_EXECUTION]: The protocol involves extensive use of shell commands through tools like gh, git, docker-compose, and jq to interact with the system and external services.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources that could be manipulated by an attacker to influence agent behavior.
Ingestion points: Fetches GitHub project item details, titles, and Pull Request bodies via the GitHub CLI, and retrieves information from a knowledge graph via mcp__memory.
Boundary markers: The skill lacks explicit boundary markers or instructions to ignore embedded commands within the fetched data.
Capability inventory: The skill has the ability to execute shell commands, run local scripts, and install remote packages.
Sanitization: There is no evidence of sanitization or validation performed on the data retrieved from GitHub or the memory service before it is used in logic or displayed.

session-start