The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads external PR comments and AI review feedback via bun gh-tool pr threads and bun gh-tool pr issue-comments in SKILL.md. These sources are untrusted external inputs.
[INDIRECT_PROMPT_INJECTION]: The instructions direct the agent to "Auto-apply (no confirmation)" certain types of suggested fixes (e.g., style fixes, obvious bugs, security fixes) from these untrusted comments, creating a pathway for malicious code to be injected via PR feedback.
[INDIRECT_PROMPT_INJECTION]: There are no boundary markers, explicit sanitization steps, or "ignore embedded instructions" warnings defined for processing the external PR content before the agent acts on it.
[COMMAND_EXECUTION]: The skill performs extensive shell command execution using git and bun gh-tool to modify the repository and push changes. While these are intended functions, they represent the capability set that an indirect prompt injection attack could exploit.

git-workflow