The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes local Git commands to manage the Pull Request lifecycle. It utilizes the subprocess.run function with arguments passed as a list, which effectively prevents shell injection attacks. The _run_git wrapper explicitly ensures that commands do not pass through a shell.
[DATA_EXFILTRATION]: To prevent accidental or malicious data leakage, the skill implements a strict path validation system. It defines a set of rejected directory parts (e.g., .git, .env, node_modules) and file suffixes (e.g., .db, .key, .pem) that are blocked from being included in any Pull Request submission.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from repository content and issue descriptions. It mitigates the risk of indirect prompt injection by explicitly categorizing this data as untrusted in its core instructions and enforcing a strict user confirmation gate requiring a specific confirmation token before executing the final submission script.
[SAFE]: The skill manages GitHub authentication tokens exclusively through environment variables and a secure authentication mechanism, ensuring that sensitive credentials never appear in command-line arguments or process listings. Additionally, it provides a redaction utility to ensure that tokens are removed from any diagnostic output or error messages shown to the user.

submit-pull-request