The Agent Skills Directory

[METADATA_POISONING]: The skill's YAML frontmatter identifies the author as 'github', whereas the provided author context is 'ilteoood'. This is deceptive metadata that could lead a user or agent to incorrectly assume the skill is an official GitHub product, impacting the assessment of its trustworthiness.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially attacker-controlled data from GitHub pull request titles, bodies, and branch names.
Ingestion points: Data enters the agent's context through commands like gh stack view --json and gh stack checkout which pull remote PR metadata and branch information.
Boundary markers: There are no explicit instructions for the agent to treat this ingested data with special delimiters to prevent instruction hijacking.
Capability inventory: The skill utilizes the gh and git CLI tools, which have the capacity for network operations and file system modification.
Sanitization: The skill's documentation provides security-focused guidance by recommending the use of JSON for parsing machine-readable state and explicitly warning against the use of eval on shell path outputs.
[EXTERNAL_DOWNLOADS]: The skill guides the installation of the gh-stack extension from the 'github/gh-stack' repository. This finding is documented neutrally as it involves a well-known service and repository.
[COMMAND_EXECUTION]: The skill involves widespread use of shell commands including git and gh. It also describes a shell helper function that uses cd on paths generated by CLI command output.

gh-stack