The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data (issue numbers and descriptions) but includes explicit defensive instructions to mitigate risks.
Ingestion points: External issue metadata used for branch naming in Step 5 and PR body construction in Step 6.
Boundary markers: The workflow utilizes quoted heredocs ('EOF') in Step 6, which is a shell best practice to prevent the execution of embedded commands during string interpolation.
Capability inventory: The skill utilizes shell-based tools including git and the GitHub CLI (gh).
Sanitization: A dedicated 'Security & Guardrails' section directs the agent to strictly normalize branch names to alphanumeric characters and to HTML-encode PR descriptions to prevent injection and XSS.
[DATA_EXFILTRATION]: The skill incorporates proactive defenses against accidental data exposure.
Evidence: Step 2 and the Constraints section explicitly forbid the use of wildcard staging (e.g., git add . or git add -A) to prevent the accidental inclusion of sensitive files like .env or local configuration in the repository history.
[COMMAND_EXECUTION]: The workflow involves standard shell command execution for development tasks. The instructions emphasize explicit path definitions and sanitized arguments, which are standard security practices for agentic tool use.

git-workflow