The Agent Skills Directory

Indirect Prompt Injection Surface: The skill processes content directly from pull requests, including diffs, titles, and descriptions, which constitutes untrusted data.
Ingestion points: Untrusted data enters the agent context through the execution of gh pr diff and the inclusion of PR metadata (Step 3 in SKILL.md).
Boundary markers: The skill's instructions do not specify the use of clear delimiters or explicit instructions for the LLM to ignore embedded commands or directions found within the PR content.
Capability inventory: The skill performs subprocess calls to gh and grep (referenced in Step 1 and Step 2) to analyze files and symbols.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the PR text before it is interpolated into the context envelope for the LLM classifier.
Command Execution Profile: The skill's logic is built upon the execution of system commands to inspect the repository state.
It utilizes gh pr diff --name-only, gh pr diff --stat, and grep to perform its analysis. These are standard utility calls for a documentation impact classifier, but they serve as the mechanism for ingesting the untrusted data used in subsequent steps.

docs-impact-classifier