The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by processing untrusted data from external sources (GitHub PR comments, reviews, and commit messages). 1. Ingestion points: scripts/fetch-pr-info.js retrieves external content via GitHub's GraphQL API and git logs. 2. Boundary markers: No delimiters or protective instructions are provided; SKILL.md explicitly directs the agent to read the entire output, including truncated sections, which increases exposure to potentially malicious instructions embedded in comments. 3. Capability inventory: The agent can execute the provided Node.js script which has full access to the git and gh CLIs. 4. Sanitization: No sanitization, escaping, or filtering is applied to the retrieved comments or messages before they are processed by the agent.
[COMMAND_EXECUTION]: The scripts/fetch-pr-info.js script uses node:child_process to execute shell commands. It performs actions such as git fetch, git log, and gh auth status -a, the latter of which exposes the user's authentication state and environment metadata to the agent context.

pr-address-comments