The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extracts an issue number from the current branch name and uses it directly in a shell command: gh issue view <number>. There is no validation to ensure the extracted string is purely numeric, allowing for command injection if a branch is maliciously named (e.g., feat/123;touch_malicious_file).
[COMMAND_EXECUTION]: The skill uses external issue content (title and body) to fill a PR template, which is then passed to gh pr create --body "<filled template>". If the issue content contains shell metacharacters or HEREDOC escape sequences, it can lead to arbitrary command execution in the shell environment where the agent runs.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill reads branch names and external issue data (title, body, labels) using the GitHub CLI.
Boundary markers: Absent. The instructions do not specify delimiters or warnings to ignore instructions embedded within the issue content when generating the PR summary.
Capability inventory: The skill possesses the ability to execute shell commands and perform network operations via the gh CLI.
Sanitization: Absent. No sanitization, escaping, or validation of the issue content is performed before it is interpolated into shell commands.
[EXTERNAL_DOWNLOADS]: The skill fetches issue information and submits pull requests to GitHub. As GitHub is a well-known and expected service for this context, these operations are consistent with the skill's primary purpose.

pr