The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill autonomously reads PR comments and CI logs which are attacker-controlled. \n
Ingestion points: scripts/fetch_pr_checks.py (CI failure logs) and scripts/fetch_pr_feedback.py (PR review comments).\n
Boundary markers: Absent. The skill instructions do not specify the use of delimiters or warnings to ignore instructions embedded in the external data.\n
Capability inventory: The skill has access to Write, Edit, and Bash tools, which can be misused if the agent obeys instructions hidden in comments or logs.\n
Sanitization: Absent. No filtering or validation is performed on the fetched content before it is processed by the agent.\n- [COMMAND_EXECUTION]: The helper scripts execute shell commands via the GitHub CLI. \n
Evidence: subprocess.run(["gh", ...]) is used in both fetch_pr_checks.py and fetch_pr_feedback.py to interact with GitHub.\n
Risk: Although the scripts use the safer list-based argument format for subprocesses, they process IDs and links extracted from GitHub API responses, which could potentially lead to argument injection if the underlying CLI tool has dangerous flags accessible through manipulated metadata.

iterate-pr