The Agent Skills Directory

Indirect Prompt Injection Surface: The skill fetches pull request comments via the gh CLI to identify dogfooding instructions (SKILL.md). Since the agent is instructed to execute commands extracted from these comments, a malicious user could attempt to inject unauthorized shell commands. The presence of the 'Dogfood this PR' boundary marker reduces accidental execution but doesn't eliminate the adversarial risk. Ingestion point: Pull request comments via gh pr view. Boundary markers: 'Dogfood this PR with:' header used as a filter. Capability inventory: Shell execution (bash/pwsh), gh CLI, Docker container runner. Sanitization: None applied to extracted command content before execution.\n- Remote Command Execution: The skill performs remote execution by downloading and running scripts from Microsoft's official GitHub repository (e.g., get-aspire-cli-pr.sh). These downloads target a trusted organization and are documented as standard procedure for retrieving pull request artifacts.\n- Command Execution and Environment Access: The skill utilizes shell execution, Docker containers, and temporary directory management to isolate test environments. It specifically avoids sensitive environment variable overrides (like HOME) to ensure tool authentication persists, which is a best practice for developer workflows.

pr-testing