The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic injection syntax ! to execute ${CLAUDE_PLUGIN_ROOT}/bin/ops-merge-scan at skill load time, which performs a repository scan before any user interaction occurs.
[CREDENTIALS_UNSAFE]: The skill instructions direct the agent to harvest sensitive credentials from the $GITHUB_TOKEN environment variable and by executing doppler secrets get GITHUB_TOKEN --plain through a password manager.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted PR review comments and treats them as instructions for fixer agents.
Ingestion points: PR comments are retrieved via gh api repos/<repo>/pulls/<number>/comments in Phase 3.
Boundary markers: There are no delimiters or explicit instructions to treat the fetched comments as untrusted data.
Capability inventory: The fixer agents have access to the Bash, Edit, and Write tools, enabling them to modify the codebase based on the input.
Sanitization: No filtering, validation, or sanitization of the comment content is performed before addressing the comments in the code.
[COMMAND_EXECUTION]: The skill executes high-privilege repository commands including git push --force-with-lease and gh pr merge --admin, which can lead to significant changes in the target repositories if misused.

ops-merge