The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it analyzes untrusted data from GitHub pull requests.\n
Ingestion points: PR metadata such as titles and bodies are ingested via gh pr list and gh pr view, and commit content is analyzed via git show as described in SKILL.md.\n
Boundary markers: The instructions lack boundary markers or delimiters to isolate untrusted PR content from the agent's internal reasoning or system instructions.\n
Capability inventory: The skill utilizes powerful tools including gh pr merge for merging code, gh pr close for closing PRs, and git push for updating remote branches.\n
Sanitization: Contributor-controlled content is processed directly by the agent without explicit sanitization or validation steps.\n- [COMMAND_EXECUTION]: The skill relies on shell commands for repository and PR management.\n
Evidence: The workflow involves executing commands such as git push <author> HEAD:<branch> --force-with-lease to modify remote forks and gh pr merge --squash to land changes. While these are intended for the skill's administrative purpose, they represent significant control over the repository state.

triage-prs