The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interacts with the GitHub CLI (gh) to read and edit pull requests. The script scripts/publish_quiz.py uses subprocess.run with argument lists to execute commands, which is a secure practice that prevents shell injection. The instructions in SKILL.md guide the agent to use standard, safe gh commands for repository exploration.
[EXTERNAL_DOWNLOADS]: The skill provides a GitHub Action workflow template (assets/pr-quiz.yml). This workflow relies on actions/github-script, an official and trusted utility maintained by GitHub, to perform its grading logic.
[DATA_EXPOSURE]: The skill reads pull request diffs and metadata to generate relevant questions. This access is restricted to the specific PR context and is necessary for the skill's primary function. No evidence was found of the skill attempting to access sensitive local files (e.g., SSH keys, credentials) or environment variables.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill reads untrusted data from GitHub pull request diffs and descriptions (gh pr diff).
Boundary markers: The instructions do not define specific delimiters for the diff content, but the agent is instructed to focus on architectural decisions rather than literal code.
Capability inventory: The skill can edit pull requests via scripts/publish_quiz.py and set commit statuses via the GitHub Action.
Sanitization: Content is processed by the AI's natural language understanding; no specific technical sanitization is applied to the diff text. While this constitutes an attack surface, the impact is limited to influencing quiz questions, which is consistent with the skill's intended use-case.

pr-quiz