The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process untrusted data from external sources, which creates a significant surface for indirect prompt injection.
Ingestion points: The skill reads pull request bodies using gh pr view --json body, as well as code diffs and specific file contents via git diff and git show. These inputs are directly controlled by the pull request author or contributors.
Boundary markers: The risk assessment is delegated to a 'fresh-context sub-agent'. While this provides a layer of isolation for the session context, the prompt provided to the sub-agent does not include explicit delimiters or instructions to ignore embedded commands within the ingested PR content.
Capability inventory: The skill possesses high-impact capabilities, most notably the ability to merge code into the base branch using gh pr merge --auto and to modify pull request metadata via gh pr edit.
Sanitization: No sanitization, escaping, or validation logic is applied to the PR body or code diffs before they are interpolated into the prompt for the risk-judging sub-agent.
[COMMAND_EXECUTION]: The skill executes various GitHub CLI (gh) and git commands. While these are essential for the skill's purpose, the automated execution of gh pr merge is a high-privilege operation that depends on the output of an LLM-based risk assessment, making it a critical point of failure if the LLM's judgment is subverted.

forge-land