The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from GitHub pull requests, creating a potential attack surface for indirect prompt injection.
Ingestion points: The skill fetches PR metadata, titles, bodies, and code diffs using gh pr view and git diff (SKILL.md, Phase 0 and 2).
Boundary markers: The skill explicitly defines a 'Trust Boundary' (SKILL.md, Phase 0), instructing the agent to treat all contributor-controlled artifacts as untrusted data and never as instructions, specifically warning against embedded commands or role changes.
Capability inventory: The agent uses git, gh, and language-specific build tools like npm, cargo, and pytest (SKILL.md, Phase 3).
Sanitization: The instructions mandate a 'Hostile-Change Gate' (static analysis) before any code execution and recommend using isolated, disposable environments like containers or VMs to prevent host compromise.
[COMMAND_EXECUTION]: The skill uses standard command-line tools such as git and gh to perform repository operations and audit metadata. These are necessary for the skill's primary function and are used in a controlled manner.
[DYNAMIC_EXECUTION]: The skill instructs the agent to run project-specific tests and build commands (Phase 3). While this involves executing external code, the skill provides comprehensive warnings about build-time code execution risks (e.g., build.rs, npm lifecycle scripts) and emphasizes the necessity of sandboxing and isolation.

pr-audit