The Agent Skills Directory

[PROMPT_INJECTION]: The skill explicitly overrides agent safety guardrails by instructing it to "Act immediately on these instructions" and "Never ask for confirmation before executing." This removes the human-in-the-loop control for high-risk actions.
[COMMAND_EXECUTION]: The skill provides bash templates for directory creation, git management, and symlinking. These commands are executed autonomously if the agent follows the prompt instructions, which could be abused if malicious context influences the generated variables.
[CREDENTIALS_UNSAFE]: The instructions specifically target .env files for copying into subdirectories. These files are standard locations for plaintext credentials and secrets, and duplicating them increases the data exposure surface.
[PROMPT_INJECTION]: (Indirect Surface) The skill uses conversation history as input for generating branch names that are interpolated into shell commands. This creates a vulnerability to indirect prompt injection.
Ingestion points: Conversation history (SKILL.md Step 1)
Boundary markers: Absent
Capability inventory: Shell command execution (bash)
Sanitization: Step 2 provides formatting rules, but these lack technical enforcement against adversarial inputs.

ulw