The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting instructions from untrusted repository files.
Ingestion points: Step 5 in SKILL.md directs the agent to read agents.md or CLAUDE.md from the root of the target repository to identify repo-specific conventions.
Boundary markers: The skill does not provide any delimiters or safety warnings to treat the content of these external files as untrusted or to ignore potentially malicious instructions contained within them.
Capability inventory: The agent has the capability to modify the local filesystem, perform git commit and git push operations, and execute gh pr create to submit code changes to remote platforms.
Sanitization: There is no mechanism described for sanitizing, validating, or filtering the instructions found in the repository-specific convention files.
[COMMAND_EXECUTION]: The skill utilizes local shell commands to interact with version control and GitHub.
Evidence: Extensive use of git for branch management and committing, and the gh (GitHub CLI) for cloning repositories and managing pull requests.

create-fix-pr