The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands for the GitHub CLI (gh) and Git using variables such as <title>, <branch>, and <slug> which are derived from the environment or external metadata.
Evidence: The workflow specifies running gh pr create --base <base> --head <branch> --title "<title>" --body-file <body>. The <title> is derived from git log <base>..HEAD. If a commit message in the branch contains shell-sensitive characters (e.g., $(touch exploit) or double quotes), it could result in command injection when the agent executes the shell command.
Evidence: The gh api calls use parameters like <b> (branch name) and {repo} in the URL path. If these identifiers are manipulated, they could lead to unexpected command behavior.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub and the repository's history to automate the composition of Pull Request content, creating a surface for indirect attacks.
Ingestion points: The skill reads data from gh issue list (titles and labels), git log (commit subjects), and git show (file contents from the branch).
Boundary markers: None. The instructions do not direct the agent to delimit or ignore instructions that might be embedded within the commit history or issue descriptions being summarized.
Capability inventory: The skill has the capability to perform git push, gh pr create, gh pr edit, and gh api operations, allowing it to commit and publish content to a remote repository.
Sanitization: While the skill correctly uses a temporary file (--body-file) to pass the PR body to the CLI (reducing shell injection risk for the body text), it interpolates the title and other metadata directly into the command string without sanitization.

open-pr