The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of shell commands to manage the software development lifecycle autonomously.
Evidence: SKILL.md steps 6, 8, and 9 invoke git push, gh pr edit, and gh run view to modify the repository state and interact with GitHub.
Context: The instructions specifically mandate a non-interactive workflow ('Do not prompt the user', 'never stops to ask'), which allows the agent to execute impactful repository operations and remote synchronization without manual review.
[PROMPT_INJECTION]: The skill contains an indirect prompt injection surface through its automated CI fix loop.
Ingestion points: In SKILL.md Step 9.2, the agent reads untrusted external data from CI failure logs using gh run view --log-failed.
Boundary markers: No delimiters or explicit instructions are provided to separate the potentially attacker-influenced log content from the agent's internal reasoning.
Capability inventory: The agent possesses the capability to modify source code, create commits, and push those changes to remote branches (git push).
Sanitization: Log content is used to 'identify the root cause and apply a fix' without apparent sanitization or validation of the input data before it influences code generation.
[DATA_EXFILTRATION]: The skill performs autonomous network operations that transmit local content and findings to remote repositories.
Evidence: SKILL.md Step 6 and Step 9 use git push and gh pr edit to update remote PRs and branches.
Context: While intended for PR management, the autonomous nature of these operations—where local changes or findings are transmitted to external servers without a user-in-the-loop confirmation—represents an exfiltration vector if the agent's logic is manipulated.

lfg