The Agent Skills Directory

[PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection. It instructs the agent to analyze code changes and generate a summary, which is then directly interpolated into a shell command (gh pr create). A malicious actor who can influence the code being analyzed might trick the agent into generating a summary that contains shell metacharacters.
Ingestion points: Local repository code and git history are analyzed to generate PR metadata.
Boundary markers: While the PR body uses a heredoc (cat <<'EOF') to safely handle multi-line content, the PR title and summary are placed inside double quotes in the shell command string.
Capability inventory: The skill utilizes git and gh (GitHub CLI) via the Bash tool.
Sanitization: No explicit shell escaping or validation logic is defined to sanitize the AI-generated summary before it is passed to the bash environment.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to execute git and gh commands. This is the intended behavior for a PR automation tool, but it relies on the security of the underlying shell environment and the lack of malicious input in interpolated variables.
[DATA_EXFILTRATION]: The skill pushes repository data to GitHub and submits PR descriptions to GitHub's API. This involves sending data to an external, well-known service (GitHub), which is necessary for the skill's documented functionality.

create-pr