The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub PR bodies, diffs, and commits to generate and update descriptions. The instructions lack explicit safety delimiters or warnings to prevent the agent from potentially following instructions embedded within the PR content being analyzed.
Ingestion points: Untrusted data enters the agent context through gh pr view, gh pr diff, and gh pr checks as specified in references/process.md.
Boundary markers: The instructions do not define delimiters or "ignore embedded instructions" warnings for the external content.
Capability inventory: The skill uses the Bash tool to modify PRs and can execute arbitrary commands extracted from the PR body.
Sanitization: There is no evidence of sanitization or instruction filtering performed on the ingested PR data before analysis.
[COMMAND_EXECUTION]: As described in references/verify-and-writeback.md, the skill is designed to extract and execute verification commands (such as make test or npm test) from the "How to Verify It" section of a PR description. While this is a core intended feature for developer workflows, it establishes a vector where a malicious PR could attempt to cause the execution of unintended shell commands during the description update process.

describe-pr