The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is explicitly instructed in Step 6 to look for checklist items in the 'How to verify it' section of the template and execute any commands found (e.g., make check test, npm test). This 'blind execution' of commands parsed from text files or PR content allows for arbitrary code execution if an attacker influences the template or the PR being described.
[DATA_EXFILTRATION]: In Step 5, the agent is directed to 'read any files that are referenced but not shown in the diff'. An attacker could craft a PR that references sensitive local files (e.g., .env, ~/.ssh/config). The agent would then read these files and include their contents in the generated PR description, which is subsequently uploaded to GitHub via the gh pr edit command in Step 9.
[PROMPT_INJECTION]: The skill ingests untrusted data from gh pr diff and commit histories. It lacks boundary markers or instructions to ignore embedded commands within this data.
Ingestion points: Untrusted data enters via GitHub CLI commands (gh pr diff, gh pr view) and local template files (thoughts/shared/pr_description.md) that may be part of a shared repository.
Boundary markers: No delimiters are used to separate the untrusted data from the agent's instructions.
Capability inventory: The agent has the ability to execute shell commands, write to the local filesystem, and perform network operations via the GitHub CLI.
Sanitization: There is no evidence of sanitization or validation of the commands extracted from text before they are passed to the shell.

describe-pr