The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to fetch and follow instructions from external sources such as repository playbooks (GET /admin/playbooks/<org>/<repo>), CONTRIBUTING.md, and PULL_REQUEST_TEMPLATE.md to resolve deployment evidence requirements. If these files are compromised or contain malicious instructions, they could influence the agent's behavior during the PR creation process.
Ingestion points: The agent is directed to read and parse repo playbooks and Markdown files located in the target repository.
Boundary markers: No specific delimiters or warnings to ignore embedded instructions in these external files are provided.
Capability inventory: The skill has access to Bash, Write, Read, Glob, and Grep tools, which allow for file system modification and command execution.
Sanitization: There is no evidence of sanitization or validation of the content retrieved from these external files before the agent processes them.
[COMMAND_EXECUTION]: The skill directs the agent to execute shell commands to satisfy PR requirements and audits.
The instructions explicitly require the agent to "Run the full test suite now" and "Screenshot the affected page" using tools like Playwright or pylot-cli.
The "Lead Self-Assessment Loop" reinforces this by demanding the agent perform actions (commands) rather than just making claims, which increases the frequency of shell interaction.

create-compelling-prs