The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub PRs, comments, and deployment logs to determine testing steps and generate summaries. This creates an attack surface where malicious content in those sources could influence the agent's actions.
Ingestion points: gh pr view, gh run view --log-failed, and external web content via agent-browser as specified in SKILL.md.
Boundary markers: The skill contains explicit rules to avoid touching servers and to remain read-only during smoke tests, but lacks specific delimiters for untrusted data interpolation.
Capability inventory: GitHub CLI (gh) for reading/writing PR comments and agent-browser for navigating staging URLs.
Sanitization: Includes an explicit instruction in SKILL.md to redact tokens, keys, cookies, and passwords before any data leaves the session.
[CREDENTIALS_UNSAFE]: The workflow in SKILL.md requires the user to provide 'SSH access' as a condition for running smoke tests, while simultaneously stating that the skill itself does not use SSH or server commands. Requesting high-privilege credentials that are not utilized by the skill's logic is a security risk that could facilitate credential harvesting.
[DATA_EXFILTRATION]: The skill is instructed to read logs from failed deployment runs and summarize them in PR comments. While redaction rules are present, there is a risk that sensitive information from the build environment could be leaked into the public PR history.
[METADATA_POISONING]: The skill enforces a 'Zero attribution' policy in SKILL.md and references/staging-handoff.md, preventing the AI from identifying itself or its tools in its output. This concealment makes automated actions less transparent and harder for users to audit for security purposes.

deploy-watch