The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and triages data from external CI logs fetched via gh run view --log-failed. These logs are treated as authoritative evidence but may contain malicious instructions if the CI environment or the code being tested is influenced by an attacker (e.g., via a malicious Pull Request). An attacker could embed instructions in the log output that the agent might inadvertently follow during its triage and fix phases.
Ingestion points: SKILL.md (Step 1 and Step 2) reads logs from external GitHub Action runs via the gh CLI tool.
Boundary markers: Absent. There are no instructions or delimiters provided to help the agent distinguish between legitimate log data and embedded malicious instructions.
Capability inventory: The agent has extensive capabilities including shell command execution (Bash), file modification, and repository operations (git push, git worktree).
Sanitization: None. The skill does not implement filtering or validation of the log content before processing.
[DYNAMIC_EXECUTION]: The skill requires the agent to "run the failing command locally until it is green" based on evidence found in the CI logs (Step 3). This creates a direct path for dynamic command execution where the payload is sourced from external, untrusted log data. If the logs are manipulated to indicate a "failing command" that is actually a malicious shell script, the agent may execute it on the host system.
[COMMAND_EXECUTION]: The skill references an external dependency or procedure called laravel-herd-worktrees for "bootstrapping" worktrees. This implies the execution of unverified setup scripts or configuration routines defined outside of the skill's manifest, which may introduce unknown security risks depending on the environment setup.

fix-ci-failures