The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes pull request comments and review feedback, which are untrusted external inputs that could contain malicious instructions.
Ingestion points: The scripts/fetch_pr_feedback.py script retrieves comment bodies and review threads from the GitHub API via the gh CLI and GraphQL.
Boundary markers: Absent. The skill does not employ specific delimiters or instruction-ignore warnings to encapsulate the external PR content when presenting it to the agent.
Capability inventory: The skill uses the gh CLI via subprocess.run in scripts/fetch_pr_feedback.py for read-only operations. The instructions in SKILL.md and references/replying.md also direct the agent to use gh for replying and git for committing changes, providing a surface for injected instructions to influence repository state.
Sanitization: Absent. There is no specific sanitization or filtering of the fetched comment text beyond basic formatting (stripping whitespace and extracting suggestion blocks).
[COMMAND_EXECUTION]: The skill executes system commands to interact with GitHub and the local repository.
The script scripts/fetch_pr_feedback.py uses subprocess.run to call the gh CLI. The implementation uses a list of arguments and avoids shell=True, which protects against basic shell injection vulnerabilities.
The skill instructions (SKILL.md and references) guide the agent to execute various gh and git commands to manage the PR workflow, such as gh pr diff, gh api for replies, and standard git commit/test operations.

fix-pr