The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository and GitHub, which could potentially contain malicious instructions intended to influence the agent's behavior.
Ingestion points: The skill reads commit messages and history via git log, repository changes via git diff, and pull request metadata/states via gh stack view --json (SKILL.md, REFERENCE.md).
Boundary markers: The instructions do not define explicit delimiters or "ignore instructions" wrappers for data ingested from the git history or external PR descriptions.
Capability inventory: The skill can execute shell commands (git, gh), perform network operations via GitHub CLI (push, submit, sync), and modify the local filesystem (rebase, checkout, commit).
Sanitization: There is no evidence of sanitization or strict schema validation for content retrieved from commit logs or PR metadata before it is presented to the agent or used in subsequent operations.
[EXTERNAL_DOWNLOADS]: The skill encourages the installation of an external CLI extension if it is not already present in the environment.
Evidence: The skill instructs the agent to suggest gh extension install github/gh-stack when the tool is missing (SKILL.md).
Note: The extension is sourced from a well-known service (GitHub) and is documented neutrally as a functional requirement.
[COMMAND_EXECUTION]: The skill uses local shell scripts and CLI tools to manage the repository state and workspace configuration.
Evidence: It invokes ${CLAUDE_PLUGIN_ROOT:-.}/scripts/stack-worktree-conflicts.sh and resolve-pr-base.sh to handle environment checks and base branch resolution (SKILL.md). It also makes extensive use of git and gh for structural repository changes.

stacked-prs