The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from several sources which could be manipulated by external actors to influence the agent's behavior.
Ingestion points: Processes Pull Request comments in review-comments.md using gh pr view --comments and gh api. Reads repository-hosted templates in creating.md and body.md via .github/PULL_REQUEST_TEMPLATE.md. Consumes external planning data (plan.summary) in creating.md.
Boundary markers: No explicit delimiters or instructions to ignore embedded instructions are provided when the agent reads these external data sources.
Capability inventory: The skill has access to sensitive operations including git push (with --force-with-lease), gh pr create, gh pr edit, and gh pr ready.
Sanitization: There is no evidence of sanitization or filtering of the ingested content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill relies on shell commands for Git and GitHub operations. Specifically, screenshots.md provides a bash script for creating git trees from local files. While the file paths are within a controlled workspace directory, the reliance on shell script generation for repository state changes increases the risk of unexpected execution if input data such as filenames were influenced by malicious input.

shipping-a-pr