The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted metadata from the local repository—including branch names, commit messages, and file diffs—to automatically generate PR titles and descriptions. This ingestion of external data creates a surface for indirect prompt injection where malicious content within the codebase or history could attempt to manipulate agent logic during the PR composition phase.
Ingestion points: Untrusted data is retrieved via git branch --show-current, git log, and git diff commands as specified in Phase 2.
Boundary markers: There are no defined delimiters or instructions to ignore embedded commands within the ingested metadata.
Capability inventory: The agent is authorized to execute shell commands through the git and gh CLI tools for repository and network operations.
Sanitization: The skill lacks instructions for sanitizing or escaping the content of commit messages or branch names before they are interpolated into shell command arguments or PR fields.

gh-pr