The Agent Skills Directory

[PROMPT_INJECTION]: The skill is subject to indirect prompt injection because it requires the agent to read and process the full output of git diff <base>...HEAD. This is an untrusted external source where an attacker could embed malicious instructions within code comments or commit messages.
Ingestion points: The agent ingests untrusted data via the git diff command in the first step of the PR creation process.
Boundary markers: The skill does not provide instructions to the agent to treat the diff content as data only or to ignore instructions embedded within the code changes.
Capability inventory: The skill leverages git and gh tools and explicitly instructs the agent to execute arbitrary shell commands to provide testing 'receipts'.
Sanitization: No sanitization or validation is performed on the diff output before it is used to draft the PR body.
[COMMAND_EXECUTION]: The skill instructs the agent to 'Run every command you are about to cite in Testing' and to copy the 'real output' into the PR. While intended for rigorous documentation, this creates a vulnerability where a malicious diff could trick the agent into running sensitive commands (e.g., environment variable listing or credential file reading) and publishing the results in a public pull request description.

pr