The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests PR comments and review bodies which are untrusted external data sources.
Ingestion points: The fetch_pr_comments.py script retrieves comment data from the GitHub API (inline, discussion, and reviews) and stores it in a temporary cache for processing.
Boundary markers: The skill uses _untrusted_doc.py to wrap all external content with <<<UNTRUSTED_EXTERNAL_CONTENT>>> markers and an explicit warning to the agent to treat the content as data only.
Capability inventory: The skill has capabilities to execute git commit, git push, and gh api (to post replies), and can run project-defined build or test tools via discover_and_verify.py.
Sanitization: The wrap_comment_bodies function recursively sanitizes free-text fields like body and diff_hunk before the agent reads them.
[COMMAND_EXECUTION]: The discover_and_verify.py script executes shell commands to verify code changes.
It scans the repository for package.json scripts, pytest configuration, Makefile targets, and language-specific test commands (go test, cargo test).
Command execution is performed via subprocess.run with shell=False using absolute paths resolved by shutil.which to prevent path injection.
[DYNAMIC_EXECUTION]: The skill dynamically determines which commands to run based on the project environment.
It identifies and executes build scripts and test suites defined in standard configuration files like package.json or Makefile to verify fixes before they are pushed.
This behavior is consistent with the skill's primary purpose of PR maintenance and is protected by the untrusted content wrapping logic.

heyeddi-pr-respond