The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from pull request bodies, comments, and external documentation to make a merge decision, creating a surface for indirect prompt injection.
Ingestion points: SKILL.md (Step 2) and references/judge.md (The spec section) specify that the agent gathers evidence from the PR's body, comments, review ledgers, QA verdicts, and linked tracker issues/docs.
Boundary markers: There are no explicit delimiters or instructions provided to the sub-agent judge to treat the ingested evidence as untrusted data or to ignore instructions contained within that data.
Capability inventory: The skill has the capability to merge pull requests into the repository (SKILL.md Step 4).
Sanitization: No sanitization or filtering is performed on the gathered evidence before it is passed to the sub-agent judge.
[COMMAND_EXECUTION]: The instructions for the sub-agent judge in references/judge.md direct the use of command-line tools such as gh and other unspecified CLIs to verify preconditions for the merge.

ship-it