The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted branch diffs to generate PR descriptions and testing instructions.
Ingestion points: The skill reads the full branch diff between a branch and its base (SKILL.md, Workflow Step 1).
Boundary markers: There are no specific delimiters or instructions defined to prevent the agent from being influenced by malicious content (such as adversarial instructions hidden in code comments or commit messages) found within the diff.
Capability inventory: The skill generates copy-pasteable shell commands for testing, deployment, and rollback (SKILL.md, Workflow Steps 4 & 5, and Example section).
Sanitization: The instructions do not specify any sanitization or validation logic for the input diff content before it is used to generate the final response.
Risk: A malicious actor could inject instructions into a codebase (e.g., in a file comment that appears in the diff) designed to trick the agent into including harmful shell commands (e.g., credential exfiltration or file deletion) in the 'Testing Instructions' or 'Rollback Plan' sections of the generated PR description, which a user might then execute.

pr-description