The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the local repository, which serves as a potential ingestion point for indirect instructions.
Ingestion points: Documentation files (AGENTS.md, CLAUDE.md, CONTRIBUTING.md), commit messages, and source code diffs mentioned in SKILL.md.
Boundary markers: The agent is instructed to follow repository rules and use structured templates, though no explicit sanitization for embedded instructions within code diffs is provided.
Capability inventory: Access to repository management via git and gh CLI tools, as well as the ability to create pull requests and upload assets to GitHub.
Sanitization: The instructions do not define specific sanitization or filtering for the content being reviewed during the PR preparation process.
[COMMAND_EXECUTION]: The workflow relies on executing shell commands using git and the GitHub CLI (gh) to inspect repository state, manage branches, and publish pull requests. It also mentions using browser or app automation tools for capturing visual evidence.
[DATA_EXFILTRATION]: The skill involves transmitting repository data and uploaded visual assets to GitHub. It includes a mandatory safety rule in SKILL.md to ensure that tokens, secrets, user records, and webhook payloads are not exposed in the PR body.

create-pr-with-evidence