The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources (GitHub issues and git diffs) and uses it to generate pull request descriptions.
Ingestion points: In SKILL.md Step 2, the skill fetches issue details including the body via gh issue view. In Step 3, it reads the full source code diff via git diff.
Boundary markers: The PR templates in Step 4 and the gh pr commands in Step 5 lack clear delimiters or instructions for the agent to ignore potentially malicious content embedded within the fetched issue body or code changes.
Capability inventory: The skill utilizes git push to upload code and gh pr create/gh pr edit to manage pull requests, providing a path for influenced content to be published to a repository.
Sanitization: There is no mechanism described to sanitize, escape, or validate the content of the issue body or the git diff before the agent interprets it for PR generation.

open-pr