The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from PR descriptions and comments to resolve stack membership.
Ingestion points: The skill reads PR branch names, body content, and comments via gh pr view to determine relationships between PRs.
Boundary markers: There are no explicit boundary markers or instructions to the agent to ignore potentially malicious directions embedded in the PR metadata.
Capability inventory: The skill uses gh and git to query PR states and post comments. While it does not perform destructive actions (push/delete), it can iterate user-provided workflows across multiple PRs.
Sanitization: The skill uses specific regex patterns and grep -oE to extract only PR numbers and branch prefixes, which significantly limits the risk of arbitrary instruction execution.
[COMMAND_EXECUTION]: The skill provides shell-based logic for the agent to execute, relying on local CLI tools to perform automation.
Evidence: Multiple code blocks in SKILL.md provide bash script templates for resolving stack membership and iterating through PR lists using gh (GitHub CLI) and git commands.
Context: The commands are standard for git workflow automation, and variables are generally quoted to prevent simple shell injection.

stack-mode