The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow in SKILL.md explicitly instructs the agent to "run pr-body.md". This temporary file is intended to hold the PR description, which is constructed from user-supplied descriptions and code deltas. Because the instruction tells the agent to execute this file, any shell commands embedded in the PR content would be run on the host system.
[REMOTE_CODE_EXECUTION]: SKILL.md contains a directive to "install dependencies and rerun once" if automated checks fail. This gives the agent broad authority to install unverified software from external package managers, creating a significant remote code execution risk through dependency confusion or malicious package injection.
[DYNAMIC_EXECUTION]: The skill uses a pattern of generating a script at runtime from user-controlled content and then executing it. This behavior is a common method for executing malicious payloads that are not present in the static files of the skill and allows for bypassing security controls.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates external data into a high-privilege execution flow.
Ingestion points: The {description} and {deltas} placeholders in SKILL.md are used to populate the content of the temporary file.
Boundary markers: There are no boundary markers or instructions to treat the file content as data only, which leads to the agent potentially executing instructions found within the PR description.
Capability inventory: The skill utilizes git, gh (GitHub CLI), and direct shell execution via the "run" command in SKILL.md.
Sanitization: The skill provides no instructions for sanitizing or escaping the content before it is written to the file and executed.

yeet