The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by processing untrusted pull request metadata.
Ingestion points: SKILL.md (Principle 6) and scope-resolution.md (Pull Requests section) instruct the agent to read PR titles, bodies, and commit messages to verify the stated intent of a change.
Boundary markers: The instructions lack explicit markers or delimiters to isolate these untrusted inputs from the agent's core instructions.
Capability inventory: The skill possesses the capability to execute shell commands (git, gh) and perform file system read operations.
Sanitization: No sanitization or validation of the PR metadata is performed before it is added to the agent's context.
[COMMAND_EXECUTION]: The skill executes various CLI commands to resolve change scopes and read code content.
Evidence: Extensive use of git diff, git fetch, git grep, git show, gh pr view, and git worktree.
Context: These operations are intended for repo analysis and follow safety principles like isolated worktrees and read-only fetches to ensure the author's local working directory remains untouched.

interface-review