The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of GitHub PR comments and reviews which could contain malicious prompts.\n
Ingestion points: External content is fetched via fetch_pr_comments.py and stored in a temporary JSON cache outside the project tree.\n
Boundary markers: The utility script _untrusted_doc.py wraps all external free-text fields (bodies and diff hunks) in <<<UNTRUSTED_EXTERNAL_CONTENT>>> tags.\n
Capability inventory: The skill possesses the ability to modify source code (applying fixes), execute build/test commands via discover_and_verify.py, and perform network operations using the gh CLI.\n
Sanitization: Instructions in SKILL.md and ANTI_PATTERNS.md explicitly direct the agent to treat wrapped content as data only and to ignore any embedded instructions or role-play attempts.\n- [COMMAND_EXECUTION]: The skill performs shell command execution to interact with version control and development tools.\n
Implementation: Commands are executed through the run_command helper in _skill_cli.py, which uses subprocess.run with shell=False. It resolves executables using shutil.which to absolute paths before execution, which prevents common shell injection and path-hijacking vulnerabilities.\n
Scope: Execution is restricted to standard tools like git, gh, and project-specific testing frameworks (e.g., pytest, npm) discovered through local configuration files.

heyeddi-pr-respond