The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub pull request comments and descriptions, which are then used as directives for fixing code. This creates a surface for indirect prompt injection attacks where a reviewer could embed malicious instructions to override agent behavior.
Ingestion points: scripts/fetch-threads.sh retrieves PR review comment bodies; references/pr-create.md and references/pr-fix.md utilize PR summaries and commit logs.
Boundary markers: The skill lacks explicit boundary markers or "ignore instructions" wrappers when processing external comment text, though references/pr-fix-parallel.md describes an escalation protocol to a human orchestrator for ambiguous cases.
Capability inventory: The agent has extensive capabilities including full GitHub API access via the gh CLI, filesystem write access via git worktree and git commit, and the ability to execute arbitrary shell scripts provided in the skill.
Sanitization: No sanitization, escaping, or instruction-filtering of the retrieved GitHub comment bodies is performed before processing.
[COMMAND_EXECUTION]: The skill makes extensive use of the gh CLI and local bash scripts to interact with GitHub and the local filesystem.
Evidence: scripts/fetch-threads.sh, scripts/reply-thread.sh, and scripts/resolve-thread.sh use gh api graphql to perform mutations and queries.
Evidence: references/pr-merge.md and references/pr-fix.md define workflows involving git worktree, git branch -D, and git push commands.

github