The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to malicious instructions embedded in pull request comments and review threads. It explicitly directs the agent to fetch external comments, "understand the feedback," and automatically "implement the requested code change."
Ingestion points: assets/references/merge-blocker-diagnosis.md and references/monitoring-loop.md fetch comments via GitHub GraphQL and REST APIs.
Boundary markers: No delimiters or "ignore embedded instructions" warnings are used when processing this untrusted data.
Capability inventory: The skill uses Bash(git *) and Bash(gh *) to modify local files, commit, and push code, providing a direct path from external input to repository modification.
Sanitization: No input validation or sanitization of comment bodies is performed.
[COMMAND_EXECUTION]: The skill uses multiple complex shell scripts (draft-pr.sh, catalyst-secret-contract.sh) that orchestrate git, gh, and jq commands. This includes dynamic generation of git credential helpers and indirect shell variable expansion to resolve environment-based secrets.

create-pr