The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) as it ingests untrusted data from external sources and uses it to guide code modifications. \n
Ingestion points: The skill fetches pull request comments, review threads, and CI/CD logs using gh api graphql, gh pr view, and gh run view (see Phase 5 and Phase 6 in SKILL.md). \n
Boundary markers: Absent. There are no instructions or delimiters provided to the agent to help it distinguish between legitimate feedback and malicious instructions embedded within the comments or logs. \n
Capability inventory: The skill has access to powerful tools including Bash, Read, Write, Edit, and Agent (listed in SKILL.md frontmatter), allowing it to execute arbitrary commands and modify any file in the repository. \n
Sanitization: Absent. The agent is explicitly instructed to "fix mechanical or correctness issues" and "fix the smallest real cause" based directly on the ingested content without any validation or filtering.\n- [REMOTE_CODE_EXECUTION]: The skill executes code and scripts from the local environment and the target repository. \n
In the preamble of SKILL.md, it sources a local script: source "${SHIP_PLUGIN_ROOT}/scripts/preflight.sh". \n
In Phase 2, it is instructed to run "the same commands the repo or CI already uses" (e.g., tests, lint, build), which involves executing arbitrary logic defined within the project's configuration files.\n- [COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to perform complex git operations (git push --force-with-lease, git rebase), interact with the GitHub CLI (gh), and monitor process execution via the Monitor tool.

handoff