The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a sequence of shell commands using git and the GitHub CLI (gh). This includes changing branches, staging files, committing, and creating pull requests.
[PRIVILEGE_ESCALATION]: The workflow explicitly guides the user to run gh auth refresh -s workflow if a push is rejected due to scope issues. The workflow scope allows the agent to create and edit GitHub Actions workflow files, which can lead to remote code execution in CI/CD environments if the agent is compromised or misled.
[DATA_EXFILTRATION]: The instruction to use git add -A stages all changes in the working directory, including untracked and modified files. This poses a risk of staging and subsequently pushing sensitive local information (such as .env files, configuration files containing secrets, or private keys) to a remote repository if they are not correctly defined in the .gitignore file.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to instructions embedded in the code diffs it processes for generating PR descriptions.
Ingestion points: File diffs and repository status processed in SKILL.md.
Boundary markers: No delimiters are used to separate user code changes from agent instructions.
Capability inventory: git commit, git push, and gh pr create operations.
Sanitization: There is no evidence of sanitization or filtering of the content extracted from files before it is used to generate the pull request body.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to "install dependencies and rerun once" if checks fail. This pattern can lead to the execution of arbitrary installation scripts or the download of malicious packages from public registries if the repository's dependency manifest (e.g., package.json, requirements.txt) has been tampered with.

yeet