The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses variables derived from the local environment, such as git branch names and PR titles, to construct shell commands for the 'git' and 'gh' CLI tools. While the instructions explicitly direct the agent to 'Quote shell arguments safely' and 'Avoid inline backticks', there is an inherent risk of command injection if the agent fails to properly sanitize or escape malicious characters provided in branch names or commit summaries.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data to generate pull request descriptions. Ingestion points: The agent reads the worktree, branch names, and file contents in SKILL.md. Boundary markers: No explicit delimiters or instructions are used to distinguish untrusted file content from the agent's logic. Capability inventory: The skill can perform file staging, commits, and remote branch pushes as detailed in SKILL.md. Sanitization: The instructions include basic shell quoting advice but do not require validation or filtering of the processed content before it is included in the PR body.

pr-opener