The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/pr_writer.py and the test script scripts/test_cli.py utilize subprocess.run to execute the local git binary and the Python interpreter. These calls are used to query repository metadata (logs, diffs, branches) and verify script versions. The commands are invoked using argument lists, which mitigates shell injection risks.
[DYNAMIC_EXECUTION]: The test script scripts/test_cli.py uses importlib to load and execute the pr_writer.py and bitbucket_server_pr.py scripts from the local file system for verification purposes. This is a standard testing practice for skill modules.
[INDIRECT_PROMPT_INJECTION]: The skill ingests commit messages and project manifests (package.json, pubspec.yaml, go.mod) from local git repositories. This creates a potential surface for indirect prompt injection if a malicious repository contains instructions designed to influence the agent's PR drafting process.
Ingestion points: Commit logs via git log, file change lists via git diff, and repository manifest files parsed in scripts/pr_writer.py.
Boundary markers: The generated output uses Markdown headers (e.g., ## Description, ## Test Plan) to structure content, but does not provide explicit warnings to the agent to treat repository content as untrusted.
Capability inventory: The skill is capable of executing git commands and reading local files within the repository context.
Sanitization: Values are formatted for output using json.dumps to ensure correct serialization, though commit messages are included in the final draft as-is.

pr-writing