The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8). It ingests untrusted data from git commit logs and file diffs to generate PR descriptions. An attacker who can commit to the target repository could craft malicious commit messages designed to hijack the agent's behavior when this skill is active.
Ingestion points: Commit logs and diff content are retrieved via scripts/git-pr-extractor.py and processed in Step 3 and Step 4 of the workflow.
Boundary markers: The instructions do not define clear delimiters or specify that the agent should ignore instructions embedded within the git diff or commit messages.
Capability inventory: The agent has the ability to execute shell commands (python3, node, git) and read local files.
Sanitization: No sanitization is performed on the data returned by the extractor script before it is passed to the language model for PR generation.
[COMMAND_EXECUTION]: The skill performs local command execution to interact with the Git environment. The script scripts/git-pr-extractor.py uses subprocess.run to execute git commands. While it uses a list-based argument format which avoids shell injection, it still provides the agent with a mechanism to execute arbitrary git commands depending on the arguments provided.
[COMMAND_EXECUTION]: The skill instructions in SKILL.md (Step 5) reference an external script skills/neo-stop-slop/scripts/analyze-slop.js. This script is located outside the skill's own directory and is not provided for analysis, making its behavior unverifiable.

neo-pr