The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on executing several system-level CLI tools to perform its tasks:
gh (GitHub CLI) is used to view, edit, and attach files to Pull Requests.
git is used to manage an orphan branch for media storage when the default attachment backend is unavailable.
ffmpeg is used to re-encode and process video files.
node is used via -e flags to execute short JavaScript snippets for JSON processing and markdown/HTML manipulation.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data which creates a vulnerability surface for indirect prompt injection:
Ingestion points: The agent reads git diff summaries (git diff --stat) and the existing PR body (via gh pr view). These sources are controlled by potentially untrusted contributors or external actors.
Boundary markers: The instructions in SKILL.md pass the diff summary to a subagent ("Haiku") without explicit delimiters or warnings to ignore embedded instructions within the diff content.
Capability inventory: The skill has significant capabilities including executing shell commands, reading/writing files in the repository, and communicating with the GitHub API to modify Pull Requests.
Sanitization: The scripts/pr-media.sh script employs a slug function to sanitize filenames (restricting them to lowercase alphanumeric characters, dots, underscores, and dashes). Additionally, when converting markdown to HTML images, the script escapes double quotes in alt text to prevent HTML attribute injection.

pr-media