The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external and potentially untrusted data sources to define its automation tasks, creating an attack surface for indirect prompt injection.\n
Ingestion points: SKILL.md (Step 4) reads linked issues, mini-specs, project instructions (e.g., AGENTS.md, CONTRIBUTING.md), and product documentation to establish pull request claims and publication requirements.\n
Boundary markers: No specific delimiters or 'ignore embedded instructions' warnings are defined for the ingested data sources to distinguish them from the skill's own instructions.\n
Capability inventory: The skill possesses significant write capabilities, including git commit, git push (Step 7, 9), and GitHub CLI operations like gh pr create and gh stack submit. It also triggers automated repair and implementation workflows via companion skills like /implement and /code-review.\n
Sanitization: The skill lacks explicit sanitization or filtering of external text for malicious instruction patterns, although it attempts to ground its claims in actual code diffs.\n- [COMMAND_EXECUTION]: The skill relies on executing shell commands via git and the GitHub CLI (gh) to modify repository state, create branches, and publish pull requests. These are intended core functionalities, but they represent the capability set accessible to potentially malicious inputs processed through the indirect prompt injection surface.

create-pr