The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from external and local sources to generate PR descriptions without using boundary markers or sanitization. Malicious instructions inside GitHub issues or project artifacts could potentially influence the agent's behavior.
Ingestion points: GitHub issue content via gh issue view, local project files issues/{N}/prd.md and issues/{N}/tasks.json.
Boundary markers: None present; external data is directly interpolated into the PR template.
Capability inventory: Includes git push and gh pr create which can modify the remote repository.
Sanitization: No escaping or validation is performed on the ingested text before use in prompt generation.
[COMMAND_EXECUTION]: The skill contains a potential shell injection point in the workflow. In Step 2a, the command gh issue view $ISSUE_NUMBER uses an unquoted variable. While the extraction logic for the issue number from the branch name is restrictive, the fallback mechanism that asks the user for a number could be exploited if the agent provides a string containing shell metacharacters without validation.
[DATA_EXFILTRATION]: The skill facilitates the transfer of local project data (git history, diff stats, and planning documents) to GitHub. As this is performed via the official GitHub CLI to a well-known service for the skill's primary purpose, it is considered standard functionality rather than a malicious leak.

create-pr