The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses various local scripts to execute system commands such as git, gh (GitHub CLI), and bun. These are used to manage pull requests, verify code changes, and audit git worktrees as part of the skill's core functionality.
[EXTERNAL_DOWNLOADS]: The scripts/bootstrap.ts file automatically triggers bun install at runtime to ensure that the commander Node.js dependency is available for the orchestration tools. This is a common pattern for self-contained developer tools.
[INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface for indirect prompt injection by ingesting untrusted data from GitHub PR comments and external files. However, the instructions explicitly warn the agent to treat review-comment text as untrusted data and triage it skeptically.
[DATA_EXFILTRATION]: The worktree-audit.sh script accesses local agent transcripts stored in the ~/.cursor/projects/ directory. While this involves reading potentially sensitive session data, it is used for legitimate features like 'Session pickup' and 'Worktree cleanup' to identify which chats are active in specific directories.
[SAFE_PRACTICES]: The scripts/orch/store.ts file implements a cleanCell function that prepends a single quote to strings starting with suspicious characters (=, +, -, @). This is a documented best practice to prevent CSV/TSV formula injection attacks in spreadsheet applications that might open the generated data files.

poteto-mode