The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructs the agent to create and execute shell scripts (e.g., manual-env.sh and reproduction/verification scripts) within the .scratchpad/ directory to facilitate manual testing and task automation.
[INDIRECT_PROMPT_INJECTION]: The agent is directed to read from progress.md and other scratchpad files to resume work after interruptions. This creates an attack surface where malicious content written to these files could influence the agent's behavior in subsequent sessions.
Ingestion points: Persistent local files in .scratchpad/ (e.g., progress.md, interview-decisions.md).
Boundary markers: None; the agent is instructed to follow the contents to resume tasks.
Capability inventory: The skill uses shell commands (kill, lsof, pgrep), file-writing capabilities, and script execution.
Sanitization: No sanitization or validation of the scratchpad file content is mentioned.
[COMMAND_EXECUTION]: The skill specifies the use of shell commands like kill, pgrep, and lsof to manage background processes and ports for manual test environments.
[CREDENTIALS_UNSAFE]: The instructions explicitly tell the agent to "Keep test credentials in the helper script." While the .scratchpad/ folder is intended to be gitignored, this practice encourages storing credentials in plain-text scripts on the local filesystem.

scratchpad-working-files