The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the gh command-line tool to verify PR visibility using raw user input (branch_name). The instruction gh pr list --head <branch-name> allows an attacker to perform shell command injection. For example, a branch name like main; touch /tmp/pwned would result in the execution of the injected command after the intended GitHub command.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its ingestion of the <branch-name> argument.
Ingestion points: The variable branch_name is captured directly from $ARGUMENTS in SKILL.md.
Boundary markers: There are no boundary markers, delimiters, or instructions provided to the agent to treat the branch name as untrusted data.
Capability inventory: The skill performs subprocess calls via uv run for backlog lookups and gh for pull request listing.
Sanitization: While the skill performs some character replacement for a 'normalized slug', it explicitly uses the original, unsanitized branch_name for the final shell execution in the success check step.

gate-push