The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection because it ingests untrusted data from external sources and has the capability to modify the repository and PR state.
Ingestion points: The skill reads PR review comments via GraphQL queries in repair-pr.mjs and threads.mjs, and it collects CI check logs using gh run view --log in ci-logs.mjs. It also reads repository-local AGENTS.md files before making changes.
Boundary markers: The instructions do not define strict boundary markers or delimiters for the content read from these external sources when presenting it to the agent.
Capability inventory: The skill possesses significant capabilities, including modifying the local file system, creating Git commits, pushing to remote repositories (publish.mjs), and performing GitHub API mutations such as resolving or replying to review threads.
Sanitization: There is no evidence of sanitization, escaping, or filtering of the external content (comments or logs) before it is processed by the AI agent.
[COMMAND_EXECUTION]: The skill's operation depends on executing multiple shell commands via node:child_process (specifically spawnSync in common.mjs). This includes git for repository management, gh for GitHub API interaction and log collection, and node to run its internal helper scripts. While these are necessary for the skill's stated purpose, the reliance on external command execution triggered by PR data requires high trust in the source data.

repair-pr