The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from pull request titles and bodies which could contain instructions targeting the agent.
Ingestion points: The gh pr view command in SKILL.md (Step 1) extracts user-controlled data including body, title, and headRefName into the agent's context.
Boundary markers: Absent. There are no instructions to the agent to treat the PR content as untrusted data or to ignore embedded instructions.
Capability inventory: The skill possesses the ability to modify repository content via gh pr edit and create external issues in Jira, Linear, or GitHub.
Sanitization: Absent. The ingested PR content is directly used to draft issue titles and descriptions and to update the PR body without filtering or escaping.
[COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (gh) to perform repository operations.
Evidence: Commands such as gh pr view <num> and gh pr edit <num> --body "..." are used to read and write PR data. These are legitimate operations for the skill's stated purpose but contribute to the capability set available if the agent is misled by processed data.

link