The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Git history and PR metadata that could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: SKILL.md (Workflow §1) uses gh pr list to fetch PR titles and metadata; references/provenance.md (§ Verifying Trailers) uses git log to extract commit messages and trailers.
Boundary markers: The skill does not define or use explicit boundary markers or "ignore instructions" prompts when ingesting external data into the stack model.
Capability inventory: The skill possesses high-impact capabilities including git push --force-with-lease, gh pr edit (base retargeting), and uv run for executing arbitrary local and delegated Python scripts.
Sanitization: There is no evidence of sanitization, escaping, or validation of PR content or commit messages before they are processed by the skill's logic.
[EXTERNAL_DOWNLOADS]: The skill attempts to install a GitHub CLI extension if it is not present in the environment.
Evidence: references/github-native.md contains the command gh extension install github/gh-stack.
Note: This operation targets the official GitHub organization, which is recognized as a well-known and trusted service.
[DYNAMIC_EXECUTION]: The skill executes Python scripts dynamically, including scripts from other registered skills.
Evidence: SKILL.md (§5) describes running scripts/ship.py from the absolute base directory of the ship-workflow skill using uv run.
Evidence: SKILL.md (§4) uses uv run to execute local scripts like scripts/validate_evals.py.
[COMMAND_EXECUTION]: The skill relies heavily on shell commands to manage repository state and interact with providers.
Evidence: Commands such as git rev-parse, git status, git merge-tree, gh pr create, and gh api are central to the skill's operational logic.

stacked-prs