The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs and executes shell commands using parameters derived directly from user input ($ARGUMENTS), including COMMIT_SHA and TARGET_BRANCH. These are used in commands such as git rev-parse, git show, git checkout, git push, and gh pr create. This pattern represents a command injection surface if the underlying agent platform does not properly escape shell-sensitive characters provided by the user.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository's git history to generate pull request bodies and summaries.
Ingestion points: The skill reads commit subjects, messages, and file statistics using git show and git log commands in SKILL.md (Steps 2, 5, 6, and 7).
Boundary markers: The instructions lack explicit delimiters or safety instructions to prevent the agent from following malicious commands that might be embedded within a commit message.
Capability inventory: The skill has the capability to write and push changes to a remote repository (git commit, git push) and create pull requests (gh pr create), which could be abused if an attacker places instructions in a commit message that the agent then summarizes or acts upon.
Sanitization: No sanitization or filtering is applied to the commit content before it is processed by the agent or included in the final pull request description.

git-backport