The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository content (diffs and logs) which creates an attack surface for indirect prompt injection. Ingestion points: Step 2 uses git diff and git log to read branch content. Boundary markers: The instructions lack explicit delimiters or isolation for the diff data. Capability inventory: The skill can push code and post comments using git push, gh pr, and gh api. Sanitization: No explicit filtering or sanitization of ingested content is mentioned.

open-pr