The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze untrusted external data from pull requests and git logs, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Pull request content and commit history retrieved via gh pr view and git log (SKILL.md, Step 1).
Boundary markers: No specific delimiters or instructions to ignore embedded commands within the analyzed code are provided.
Capability inventory: The agent has the capability to write and execute scripts locally and read the file system to verify code behavior.
Sanitization: There are no explicit sanitization steps for the data retrieved from external repositories.
[DYNAMIC_EXECUTION]: The skill encourages the agent to generate and execute its own scripts or tests to verify the safety of code changes.
Evidence: Step 5 in SKILL.md explicitly instructs the agent: 'Write a script or test that runs the real code, run it, and paste what happened.'
Risk: While intended for testing, this pattern involves the runtime generation and execution of code based on the agent's interpretation of a potentially untrusted codebase.

blast-radius