The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted content from external pull requests and local branches, including specialized instruction files like AGENTS.md and .github/instructions/**/*.instructions.md.
Ingestion points: Pull request metadata (titles, descriptions, comments) and file content/diffs from GitHub, Azure DevOps, or local git repositories.
Boundary markers: The instructions emphasize a read-only role and provide a specific structure for the output, but do not explicitly use delimiters to separate untrusted PR content from the agent's internal instructions.
Capability inventory: The skill uses git commands and provider-native tools (like gh or az CLI) to read repository state and diffs. It is explicitly forbidden from performing write operations, merges, or credential scraping.
Sanitization: The skill does not specify methods for sanitizing or escaping the content retrieved from external sources before analysis.

pr-walkthrough