The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and follow instructions from repository files, which creates a surface for indirect prompt injection if those files are controlled by a malicious actor.
Ingestion points: The agent is instructed to read Repository Guidelines, CLAUDE.md, AGENTS.md, and CONTRIBUTING.md (SKILL.md).
Boundary markers: None are specified; the agent is told to "Run ALL checks" and "follow any PR rules" found in these files without specific isolation.
Capability inventory: The skill has shell execution capabilities via git, gh, and glab, and it is encouraged to run arbitrary check commands defined in the aforementioned files.
Sanitization: No sanitization or validation of the commands or instructions found in these files is mentioned.
[COMMAND_EXECUTION]: The skill executes shell commands using standard developer tools to perform version control operations and interact with hosting provider APIs.
Evidence: The workflow utilizes git push, gh pr create, glab mr create, and gh pr checks to automate the PR/MR lifecycle.
[DATA_EXFILTRATION]: The skill instructs the agent to include internal platform metadata and auth-gated links in the pull request description, which may expose operational details to anyone who can view the PR.
Evidence: Workflow step 5 requires the agent to include $APP_URL/tasks/, $APP_URL/sessions/, and live.agent-fs.dev links in the PR body under the "Swarm provenance" section.

create-pr