The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches untrusted data from GitHub PR comments and review bodies, which are then used as instructions for the agent to implement fixes.
Ingestion points: The helper script scripts/gh_pr_ops.ts fetches comments using the gh api command in the fetchUnified function.
Boundary markers: The skill does not implement delimiters or warnings to the LLM to ignore instructions embedded within the fetched GitHub comments.
Capability inventory: According to SKILL.md, the agent is expected to "Implement the requested fix", "Verify", "Commit", and "Push" based on the content of the comments. This provides a high-impact capability surface for malicious instructions inside PR comments.
Sanitization: No sanitization or filtering of the comment body is performed beyond checking for a bot prefix and existing reactions.
[COMMAND_EXECUTION]: The skill relies on a TypeScript helper script scripts/gh_pr_ops.ts that executes the GitHub CLI (gh) via execFileSync.
Evidence: The runGh and runGhGraphql functions in scripts/gh_pr_ops.ts use node:child_process to execute shell commands. While the use of execFileSync with an argument array prevents standard shell injection, the skill still grants the agent the ability to interact with the GitHub API using the user's credentials.

gh-pr