The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local repository state and GitHub API responses, which could contain malicious instructions.
Ingestion points: Data is ingested from git status output, gh pr list results, and user-provided inputs for the PR body.
Boundary markers: The skill uses a structured Markdown template to organize inputs, but lacks explicit guardrails against instructions embedded within branch names or commit messages.
Capability inventory: The agent can execute git and gh commands, perform network operations via the GitHub CLI, and write to the local file system (e.g., /tmp/pr-body.md).
Sanitization: Includes instructions to verify the final PR body for escaped control sequences and to remove internal guide comments.
[COMMAND_EXECUTION]: The skill executes multiple shell commands (git, gh, jq) and interpolates variables (like branch names and PR metadata) into command strings.
[DYNAMIC_EXECUTION]: The skill generates and writes a temporary file (/tmp/pr-body.md) at runtime by populating a template with user-supplied and environment-derived data before passing it to the gh command.

gh-pr