The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads external data from GitHub issues and Pull Requests that could be controlled by an attacker.
Ingestion points: Data from gh issue view and gh pr view (specifically state, stateReason, body, and baseRefName) is ingested into the agent's context in SKILL.md.
Boundary markers: No explicit delimiters or instructions are provided to the agent to disregard instructions embedded within the ingested issue/PR data.
Capability inventory: The skill possesses extensive capabilities including local command execution (git, gh), running project-defined quality gates (lint/test scripts), and modifying the remote repository state (push, PR creation/editing).
Sanitization: The skill does not perform sanitization or escaping of the external content before it is interpolated into the PR body or used to inform the agent's actions.
[COMMAND_EXECUTION]: The skill relies on executing various shell commands to perform its core functions.
Evidence: Instructions include the execution of git fetch, git merge, git push, and gh pr create. It also dynamically resolves and executes project-specific scripts such as quality, lint, or test defined in AGENTS.md or package.json.

ship