The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub PR titles, bodies, and review comments.
Ingestion points: Data is retrieved using gh pr view and GraphQL reviewThreads queries in modes/start.md, modes/fix.md, and modes/list.md.
Boundary markers: The instructions lack specific boundary delimiters or guidelines to ignore instructions embedded in the PR data.
Capability inventory: The skill is authorized to use Bash, Read, and Write tools to perform shell commands and file modifications.
Sanitization: There is no explicit requirement to sanitize or validate strings fetched from the GitHub API.
[DYNAMIC_EXECUTION]: The skill executes installation and development scripts based on project manifest files found within repositories.
Evidence: In modes/start.md, the skill detects manifest files like package.json or pyproject.toml and runs the corresponding installation commands.
Risk: A malicious PR could contain modified build scripts that execute arbitrary code when the agent sets up the project environment.

mergekit