The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a robust mitigation strategy for processing untrusted data (PR comments). The scripts/_untrusted_doc.py utility wraps external text in <<<UNTRUSTED_EXTERNAL_CONTENT>>> boundary markers and provides explicit instructions to the agent to treat the content as data only. This pattern is applied to ingestion points in scripts/fetch_pr_comments.py where data enters the agent context.\n- [COMMAND_EXECUTION]: The skill executes various CLI tools (git, gh, npm, pytest, etc.) to perform its duties. All command executions are handled via subprocess.run with shell=False and explicit argument lists, and executables are resolved using absolute paths via shutil.which. This prevents command injection vulnerabilities from occurring during local command invocation.\n- [DATA_EXFILTRATION]: Sensitive or ephemeral data, such as PR comment caches and inventory lists, are stored in the system's temporary directory rather than the project's repository. This practice, implemented in scripts/_temp_store.py, prevents accidental exposure or commits of external data or sensitive metadata to the user's repository.\n- [PRIVILEGE_ESCALATION]: Security gates are enforced via scripts/assert_no_merge.py and scripts/assert_fixes_pushed.py. These tools prevent the agent from performing unauthorized merge operations or claiming a fix is complete before it has been pushed to the remote repository, ensuring human oversight for critical workflow transitions.

heyeddi-pr-respond