The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources to construct pull request metadata.
Ingestion points: Reads data from git log (commit messages), git diff (code changes), gh issue view (issue descriptions), and repository-hosted pull request templates.
Boundary markers: While it structures output into standard PR fields (Summary, Changes, Test plan), it does not implement specific delimiters or instructions to ignore potential commands embedded within the ingested git/issue data.
Capability inventory: Performs file writes (temp files), commit operations, and network-bound CLI calls (gh pr create, gh issue edit).
Sanitization: The skill uses --body-file for PR creation, which mitigates shell-level injection, but does not explicitly sanitize the natural language content derived from external sources before interpolation.
[COMMAND_EXECUTION]: The skill executes a wide range of shell commands using git and the GitHub CLI (gh).
These operations include branch management, rebasing, pushing, and interacting with the GitHub API. All operations target a well-known service (GitHub), which is generally considered safe, but the complexity of the command chains (especially during rebases and conflict resolution) increases the attack surface for malicious local repository configurations.

prkit