The Agent Skills Directory

[COMMAND_EXECUTION]: The instruction to "run pr-body.md" after writing AI-generated content to it is highly irregular and dangerous. Since the file contains markdown generated by the AI based on repository diffs, executing it as a script allows for arbitrary command execution. Additionally, the skill uses environment variables like GH_PROMPT_DISABLED=1 and GIT_TERMINAL_PROMPT=0 to suppress user prompts, reducing oversight during execution.
[DYNAMIC_EXECUTION]: The workflow generates a file (pr-body.md) from dynamic inputs and then instructs the agent to "run" the file, which constitutes a dynamic code generation and execution pattern.
[REMOTE_CODE_EXECUTION]: The skill grants the agent authority to "install dependencies" if automated checks fail. This allows the execution of arbitrary package manager commands to pull and install unverified software from external registries, posing a significant supply chain risk.
[METADATA_POISONING]: The skill frontmatter claims the author is "openai", which contradicts the actual author "davila7". This deceptive metadata may mislead users about the skill's origin and safety.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository diffs and issue descriptions to generate the PR body. Evidence: 1. Ingestion: Repository deltas and issue content are used to generate the PR description; 2. Boundary markers: No delimiters or instructions to ignore embedded commands are present; 3. Capability inventory: The skill can execute shell commands, install packages, and push to remote repositories; 4. Sanitization: There is no evidence of filtering or escaping logic for the external content interpolated into the PR body file.

yeet