The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple shell commands using the gh (GitHub CLI) and git tools to perform repository operations.
Evidence: The skill uses gh pr view, gh api, gh pr checks, gh pr merge, git log, git diff, and git checkout to interact with GitHub resources and the local file system.
Impact: These commands are used for PR validation, merging, and cleanup. While powerful, they are gated by a mandatory user confirmation step in the workflow.
[DYNAMIC_CONTEXT_INJECTION]: The skill uses a platform-specific feature to execute a shell command at the moment the skill is loaded.
Evidence: The header contains !gh pr view --json number,title,state -q '"PR #(.number): (.title) ((.state))"' 2>/dev/null``.
Impact: This command executes silently to provide contextual information in the UI. In this specific instance, the command is benign and targeted at retrieving metadata for the current PR.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could potentially be manipulated by an attacker to influence the agent's behavior.
Ingestion points: The skill fetches PR titles, descriptions, review comments (gh api repos/$REPO/pulls/$PR/comments), commit messages (git log), and diffs (git diff) in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions telling the agent to treat the content of PRs, comments, or commit logs as untrusted data.
Capability inventory: The agent has the ability to merge PRs, delete branches, and modify milestone statuses (gh api ... --method PATCH) across several steps in SKILL.md.
Sanitization: No sanitization or validation is performed on the text returned from these external sources before the agent processes it for decision-making (e.g., validating the checklist).

github-pr-merge