The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub PR descriptions, review comments, and CI logs, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Data is ingested from GitHub review threads, top-level comments, and CI job logs via the scripts/pr-watch.sh helper and gh CLI commands.
Boundary markers: The skill contains explicit instructions in SKILL.md to treat review text and CI logs as evidence and not to execute commands from them. references/feedback.md specifically forbids building shell expressions from review bodies.
Capability inventory: The skill has the capability to modify the local filesystem (applying code fixes), commit changes, and push code to remote GitHub repositories.
Sanitization: Untrusted data is handled using jq and git hash-object in the helper script to prevent shell interpolation. The instructions emphasize judging evidence rather than obeying instructions embedded in logs or reviews.

ward