The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill processes untrusted content provided by contributors in GitHub pull requests, including titles, descriptions, and commit messages.
Context: Ingesting external data into the agent's context could lead to the execution of unintended instructions if the agent misinterprets that data as commands.
Evidence: The skill reads PR metadata and files into its context in SKILL.md (Step 1 and Step 2).
Mitigation: The instructions explicitly direct the agent to treat this content as data only, ignore any directives found within it, and log potential injection attempts in the audit trail.
[Command Execution]: The skill executes commands using the gh CLI and a local Python module for project verification.
Context: Running shell commands is a standard capability for development-oriented skills but requires oversight to ensure operations remain within expected bounds.
Evidence: Commands such as gh pr review --approve are executed in SKILL.md (Step 3b), and python3 -m setup_preflight is used in the Pre-flight section.
Mitigation: Actions are scoped specifically to PR management. Crucially, the skill adheres to a 'never merge' rule, providing manual commands to the maintainer instead of executing them autonomously. State-changing actions like approvals require explicit human confirmation.
[Local Configuration and File Access]: The skill reads and evaluates local project configuration files and monitors file paths in the target repository.
Context: Accessing local files is necessary for project-specific customization and PR screening.
Evidence: The skill accesses .apache-magpie-local/ and .apache-magpie-overrides/ for configuration and checks changed files against allow/deny lists in candidate-rules.md.
Mitigation: File access is restricted to defined configuration directories, and a robust deny-list prevents the skill from approving changes in sensitive repository areas such as security modules, authentication logic, or CI configurations.

quick-merge