The Agent Skills Directory

Indirect Prompt Injection Surface: The skill is instructed to read all pages of pull request discussions, including inline review threads, replies, and top-level comments. This ingestion of external data from contributors and reviewers creates a surface where instructions embedded in PR comments could potentially influence agent behavior during the 'Finish' and 'Reply' phases.
Ingestion points: The skill reads PR bodies, issue comments, and review threads using gh api and GraphQL queries (documented in SKILL.md).
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' prompts when processing these discussions.
Capability inventory: The agent can modify the PR body, post comments, resolve review threads, apply labels, and execute repository-local scripts and tests.
Sanitization: There is no explicit requirement to sanitize or filter the content retrieved from GitHub discussions before processing it.
Execution of Repository-Local Scripts: The skill facilitates the execution of scripts located within the repository, such as scripts\capture-terminal.ps1, and requires running local tests to validate behavior. While these are standard developer workflow actions, they involve the automated execution of scripts residing in the managed environment.
PR Modification Capabilities: The skill has the authority to update PR metadata and content. However, it includes explicit negative constraints, such as prohibiting the agent from merging, enabling auto-merge, bypassing branch protection, or manufacturing approvals, which serves as a significant safety boundary.

pr-lifecycle