The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses ! syntax in SKILL.md to execute shell commands (git status, git branch, git log, gh auth status, git diff) at load time. These are used to populate the agent's context with repository state and authentication status. The use of these commands is consistent with the skill's primary purpose of PR creation.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data from $ARGUMENTS in Phase 3 to generate the PR title and body. This represents an attack surface where malicious instructions embedded in the user's PR description could influence the agent's behavior during the assembly process.
Ingestion points: $ARGUMENTS provided to the skill in SKILL.md (Phase 3).
Boundary markers: Explicit instructions exist to strip command flags, but no boundary markers (e.g., delimiters) are specified for the descriptive text interpolated into the PR body.
Capability inventory: The skill has network access via gh (GitHub CLI) for PR creation and metadata updates, and calls Skill("github:review-pr", ...) for downstream actions.
Sanitization: Instructions are provided to differentiate between flags and content, though no specific sanitization for natural language instructions in the content is mentioned.

create-pr