The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions mandate that the agent read "applicable agent instructions" and project documentation from within the target repository being audited. This creates a surface for Indirect Prompt Injection, where a malicious repository could contain instructions designed to manipulate the audit classification or influence the agent's cleanup logic.
Ingestion points: The SKILL.md file (Scope and Audit sections) requires the agent to read instructions and documentation from the target repository filesystem.
Boundary markers: No specific boundary markers or delimiters are defined to separate repository-provided instructions from the skill's core logic.
Capability inventory: The skill is capable of file deletion (git worktree remove, permanent file deletion) and service management (stopping/starting writers or schedulers).
Sanitization: The skill mitigates this risk by requiring a mandatory "Approval gate" where the user must explicitly approve specific item IDs before any destructive actions are executed.
[COMMAND_EXECUTION]: The skill executes potentially destructive system commands and manages service states based on the results of its audit.
Evidence: The skill uses git worktree remove and performs permanent file deletion for artifacts.
Evidence: The instructions authorize stopping and starting system services or "writers/schedulers" to facilitate the removal of locked database files or artifacts.

repo-cleanup