The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository's environment which could contain malicious instructions designed to influence the agent's behavior during PR generation.
Ingestion points: The skill reads data from git log, git diff, local branch names, and .github/pull_request_template.md (all of which are user/attacker-controlled if the repository is untrusted).
Boundary markers: No explicit boundary markers or XML-style tags are used when interpolating this data into the prompt for PR title and body generation.
Capability inventory: The skill has the capability to execute git push and gh pr create via the Bash tool.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from git logs or diffs before it is used to generate the PR content.
Mitigation: The skill includes a mandatory user confirmation step (Ask for confirmation) where the agent previews the generated title and body before performing any network operations.
[DYNAMIC_EXECUTION]: The skill generates a temporary markdown file at runtime to facilitate the pull request creation process.
Evidence: In step 5, it writes a PR body to a temporary path: BODY_FILE="/tmp/pr-body-$(date +%s).md". This file is then used as an argument for the gh pr create --body-file command in step 7. While this is standard practice for PR automation, generating and referencing local files is a form of dynamic content creation.

git-create-pr