The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, specifically the repository's commit history and GitHub pull request metadata, which could contain malicious instructions.
Ingestion points: The skill executes git log -8 --format='%s%n%b---' and gh pr list --state merged --limit 5 --json title,body to read historical text (referenced in SKILL.md and references/voice.md).
Boundary markers: There are no explicit delimiters or instructions to ignore commands that might be embedded in the commit messages or PR bodies being read.
Capability inventory: The skill has access to the Bash tool as specified in the allowed-tools section of SKILL.md, allowing for command execution.
Sanitization: The skill does not perform sanitization or filtering of the output from git or gh before using it to influence the agent's output generation.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using Bash to inspect the local environment.
Evidence: SKILL.md and references/voice.md contain instructions to run git log, gh pr list, and ls .github/PULL_REQUEST_TEMPLATE.md to gather context about the repository's house style.

not-spam-pr