The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and actions content from external sources.
Ingestion points: The skill uses gh pr view to fetch reviews, reviewThreads, and comments from the pull request (found in SKILL.md under the 'Workflow' section).
Boundary markers: The instructions do not specify the use of delimiters or boundary markers when processing the text of these reviews or comments.
Capability inventory: The agent has the capability to write files, commit changes, and execute shell commands (npm, npx, git) based on the feedback it processes.
Sanitization: There is no explicit sanitization or filtering logic mentioned for the content retrieved from PR reviews.
[COMMAND_EXECUTION]: The skill performs shell command execution to validate the code locally before pushing changes.
Evidence: The skill executes npm run build, npm run lint, npm test, and npx ts-node scripts/ci/postprocess-smoke-workflows.ts as part of its 'Checks' and 'Workflow' steps in SKILL.md. These are standard development tasks but provide a mechanism for code execution that could be exploited if the repository's configuration files are maliciously modified.

pr-finisher