The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub pull request records and code diffs which may contain malicious instructions designed to alter agent behavior.
Ingestion points: Uses gh pr view and gh pr diff in SKILL.md (Gather the facts) to read external content.
Boundary markers: Output is wrapped in  and  markers.
Capability inventory: Accesses the file system (reading/writing recap.md, sketch.png), executes shell commands (gh, bun, curl), and performs network operations via the GitHub CLI.
Sanitization: Explicitly redacts secrets and credentials from output, but lacks specific protection against prompt injection in ingested text.
[EXTERNAL_DOWNLOADS]: The skill's sketch rendering tool performs dynamic package installation at runtime.
Evidence: sketch.mjs executes bun install --frozen-lockfile to fetch pinned dependencies from the official registry. It also provides a fallback path using npx to download and run the bun environment if not present locally.
[COMMAND_EXECUTION]: The skill relies on executing external CLI tools to perform its core functions.
Evidence: Instructions in SKILL.md call gh for PR data and API interactions, bun or node for script execution, and curl for verifying image accessibility. Commands include sensitive operations like gh auth token to authorize attachment checks.
[DYNAMIC_EXECUTION]: The sketch tool uses dynamic loading and runtime compilation techniques to generate images.
Evidence: sketch.mjs uses createRequire and dynamic imports to load its rendering logic (draw.mjs) and dependencies after installation. It also uses spawnSync to manage its runtime environment and install packages dynamically.

pr-recap