The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute several local commands and scripts to verify the environment and build documentation.
It executes python3 scripts/build_docs.py --check and python3 .github/actions/gate/run.py to validate the repository state.
It probes extracted commands by running them with the --help flag to confirm their existence.
It uses system utilities like cp -n, grep, and ls for file management and searching.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources including incident notes, chat logs, postmortems, and tickets.
Ingestion points: Untrusted data enters the agent context via incident notes, chat logs, tickets, and shell history (Step 4).
Boundary markers: The instructions lack explicit boundary markers or delimiters to separate the untrusted source content from the agent's instructions, increasing the risk of the agent following instructions embedded within the logs.
Capability inventory: The skill has the capability to write new files to the repository (docs/), execute local Python build scripts, and run shell commands (Steps 5, 6, and 8).
Sanitization: The skill includes a rule to prevent secrets (passwords/tokens) from being written to pages, but lacks general sanitization for instruction-like content in the input logs.
[DATA_EXFILTRATION]: While not performing network exfiltration, the skill accesses environment variables and external paths to load configuration.
It reads the $POWERSUIT_OVERLAY environment variable and accesses files within that directory to override skill behavior.
It accesses $CLAUDE_PLUGIN_ROOT to copy templates. While intended for local configuration, this behavior expands the data access scope of the agent.

runbook