The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides workflow templates that process untrusted data from pull requests, which could be leveraged by an attacker to influence automation outcomes.
Ingestion points: Workflow steps in SKILL.md read content from github.event.pull_request.title (Step 5), github.event.review.user.login (Step 3), and code diffs (Step 4).
Boundary markers: The instructions do not specify any delimiters or instructions for the agent/automation to ignore malicious instructions embedded within the pull request metadata or code.
Capability inventory: The skill is designed to write workflow files, execute gh api calls to modify repository protection settings (Step 6), and perform network notifications via Slack webhooks (Step 5).
Sanitization: PR titles and review states are interpolated directly into Slack notification payloads without explicit escaping or validation steps.
[EXTERNAL_DOWNLOADS]: The skill references several external GitHub Actions for CI/CD automation.
The workflow examples include actions/checkout@v4, actions/github-script@v7, and slackapi/slack-github-action@v1.27.1, all of which originate from well-known and reputable organizations.
[COMMAND_EXECUTION]: The skill includes instructions to programmatically alter repository security configurations.
Step 6 provides a shell script that uses the GitHub CLI (gh api) to update branch protection rules, requiring specific status checks and enabling administrator enforcement.

coderabbit-ci-integration