The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill summarizes external, untrusted data including git diff output, commit history, and existing PR bodies into new PR descriptions. A malicious user or an attacker contributing to the codebase could inject instructions into these sources to manipulate the generated PR metadata or summary.
Ingestion points: Git status, git diff, commit logs, existing PR data via gh pr view, and the conversation history (Steps 1a, 1b).
Boundary markers: The skill uses markdown headers for structural organization but lacks explicit "ignore embedded instructions" delimiters to prevent the agent from inadvertently following commands found within the summarized code or text (Step 5).
Capability inventory: The skill uses Bash to execute git and gh (GitHub CLI) commands, writes files, and delegates tasks to other agent skills such as evidence-gate and pr-evidence-comment (Steps 1, 5, 5.5).
Sanitization: No explicit escaping, validation, or filtering of the ingested data is specified before it is interpolated into the final PR description (Step 5).

pr