The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the !command syntax in the SKILL.md file to execute shell commands at load time for context gathering.
Specifically, it executes git branch, git status, gh pr view, and git log to populate variables for the agent.
These commands are benign, strictly related to the skill's stated purpose of PR management, and do not incorporate user-supplied arguments or access sensitive directories like .ssh or .aws.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests untrusted data from the local repository environment.
Ingestion points: Data enters the agent's context through git log output and gh pr view metadata (SKILL.md).
Boundary markers: The skill uses markdown headers and list structures to organize context, though it lacks explicit instructions to ignore embedded commands in the ingested git data.
Capability inventory: The skill uses git commit, git push, gh pr create, and gh pr edit (SKILL.md).
Sanitization: There is no explicit sanitization of commit messages or PR descriptions derived from external inputs.
Despite this surface, the risk is minimal as the skill's capabilities are limited to standard version control operations and do not involve remote code execution or data exfiltration.

pr