The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources such as git diffs, commit messages, and test results to generate pull request descriptions. This represents a potential surface for indirect prompt injection if malicious instructions are embedded within the code changes or commit history.
Ingestion points: As described in SKILL.md, the agent reads the "complete diff against that base", "included commits", and "relevant verification output".
Boundary markers: The skill contains a mandatory "Authorization Boundary" section that explicitly forbids publishing or pushing changes without user consent, which serves as a primary control.
Capability inventory: The agent has the ability to read files from the repository, execute the local scripts/render_pr.py tool, and interact with external pull request APIs to update or publish content.
Sanitization: The scripts/render_pr.py script performs structural validation of the pull request title but does not specifically sanitize the summary or change descriptions for embedded AI instructions.
[COMMAND_EXECUTION]: The skill uses a local script to format and validate data.
Evidence: SKILL.md instructs the agent to run python3 scripts/render_pr.py with multiple arguments derived from its analysis of the diff.
Safety: The script (scripts/render_pr.py) is bundled with the skill and relies exclusively on Python standard libraries (argparse, json, re, sys). It does not perform network operations, access sensitive credentials, or attempt to escalate privileges.

harness-pr