The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data that can influence agent behavior and command execution.
Ingestion points: The agent is instructed to "Read the repo instructions" (SKILL.md, Step 1) and "Collect the open feedback: human reviews, bot and issue comments, unresolved and outdated threads" (SKILL.md, Step 6).
Boundary markers: The skill defines structured blocks like ## Delivery gate and ## Review gate for its own reporting, but it does not specify markers or instructions to isolate or ignore potentially malicious commands embedded in external PR feedback or repository configuration.
Capability inventory: The agent is authorized to execute shell commands via "repo-defined tests and checks", "lint", "typecheck", and "build" (SKILL.md, Step 4), and performs repository write operations including git push and git merge (SKILL.md, Step 7).
Sanitization: There is no mention of sanitizing, escaping, or validating the content of PR reviews or repository-provided instructions before the agent acts on them or incorporates them into the "Delivery gate" receipt.
[COMMAND_EXECUTION]: The skill's primary function involves executing scripts and binaries defined within the local repository environment.
Evidence: The instructions require the agent to "Run the smallest repo-defined tests and checks" and "run the repo's lint, typecheck, and build for the changed code" (SKILL.md). This allows the execution of any command defined in the repository's configuration files (e.g., package.json, Makefile) under the agent's current permissions.

ship-it