The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted repository content, such as commit messages, file diffs, and pull request templates, to generate the final PR title and description. This metadata synthesis creates an indirect prompt injection surface where malicious instructions embedded in the codebase could attempt to influence the agent's output.
Ingestion points: Git commit history (git log), worktree diffs (git diff), and local PR templates.
Boundary markers: The skill employs explicit ownership tags () and pre-defined sections to structure its output.
Capability inventory: The skill is capable of pushing code to remote repositories and creating or editing pull requests via the gh CLI.
Sanitization: The skill uses shell-safe quoted heredocs (<<'EOF') when passing generated text to CLI tools, effectively preventing the untrusted content from triggering shell command injection.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform repository management tasks. These operations are restricted by a platform-level allow-list to a specific set of git and gh subcommands, mitigating the risk of arbitrary command execution.

pr