The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on several shell-based tools including git, gh (GitHub CLI), and yarn. It executes sequences for branch management, cherry-picking, committing, pushing, and creating pull requests. It also runs project scripts like yarn format, yarn lint:fix, and yarn build:dev.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the ingestion of external data.
Ingestion points: The skill fetches PR metadata (titles, bodies, and commit messages) from GitHub using the gh pr view command (SKILL.md).
Boundary markers: There are no explicit boundary markers or instructions to treat the ingested data as untrusted text.
Capability inventory: The agent possesses the capability to modify the local file system (git cherry-pick), execute project-defined code (yarn build:dev), and perform network operations (git push, gh pr create).
Sanitization: The instructions explicitly direct the agent to pass user-provided inputs, such as the PR identifier, "unchanged" into shell commands (gh pr view <PR>). This practice can lead to command injection if the execution environment does not provide automatic shell escaping for the <PR> variable. Furthermore, PR titles are directly interpolated into git commit and gh pr create titles without sanitization.
[DYNAMIC_EXECUTION]: The skill executes build and linting scripts (yarn build:dev, yarn lint:fix) on code that has been cherry-picked from a merged pull request. Although the source is the repository's own merged history, this involves executing code that could contain malicious changes if the upstream branch was compromised.

backport-pr