The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses bash scripts to iterate over Git branches and execute commands like git push and gh pr edit. These scripts interpolate branch names and PR numbers directly into shell commands. If a branch name contains shell metacharacters (e.g., created by a malicious collaborator), it could result in arbitrary command execution when the agent runs the provided snippets.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Git and GitHub as part of its core workflow without sufficient sanitization or isolation.
Ingestion points: Data enters the agent context through git branch --list and gh pr list outputs (SKILL.md).
Boundary markers: No delimiters or instructions are used to signal to the agent that it should ignore instructions embedded in the branch names or PR descriptions.
Capability inventory: The skill has significant capabilities, including executing shell commands, modifying remote repository state via git push, and editing Pull Requests via the GitHub CLI (SKILL.md).
Sanitization: The skill lacks logic to sanitize or validate strings retrieved from the Git environment before passing them to the shell or using them as CLI arguments.

stack-rebase