The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses the gh CLI to trigger GitHub Actions workflows (gh workflow run). This initiates the execution of code contained within pull request branches. Although the skill restricts execution to branches within the same repository to prevent execution of untrusted forks, the branch content is still potentially malicious until it has been reviewed.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to instructions embedded in the data it processes because it requires the agent to interpret a PR's content to determine execution parameters.
Ingestion points: The agent reads the PR metadata and the contents of the skills/<slug>/SKILL.md file via the GitHub API to decide how to invoke the workflow.
Boundary markers: The instructions do not specify any delimiters or safety warnings to ensure the agent ignores instructions embedded within the untrusted PR files it is inspecting.
Capability inventory: The agent has the ability to trigger workflows (actions:write), post pull request comments (pull-requests:write), and perform general API operations.
Sanitization: No explicit sanitization, escaping, or strict schema validation is applied to the PR content before the agent uses it to choose the proof_var parameter for the workflow dispatch.
[COMMAND_EXECUTION]: The skill constructs and executes shell commands using the gh CLI. While it validates the format of the initial target variable, the values for $repo, $head_branch, and $proof_var are derived from the external repository state, which could lead to command manipulation if the agent is influenced by malicious PR data.
[PRIVILEGE_ESCALATION]: The skill leverages high-level permissions (actions:write) to manually trigger CI workflows and post automated verification receipts. This capability could be abused to execute code that would otherwise be blocked by standard CI gates or to misrepresent the safety of a pull request through automated "proven" receipts.

create-prove