The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources that are not fully controlled by the agent, creating a vector for instructions to be injected via GitHub issues or reviews.
Ingestion points: The agent is instructed to read issue comments (gh issue view --comments) in Step 1 and pull request review comments (gh api .../comments) in Step 8.
Boundary markers: The skill lacks explicit boundary markers or system-level instructions to ignore potential commands embedded within the text fetched from GitHub.
Capability inventory: The agent possess extensive capabilities including filesystem access (via worktrees), dependency management (npm install), and repository mutation/interaction (git push, gh pr create, gh api for mutations).
Sanitization: No sanitization or filtering is applied to the metadata or comments retrieved from the GitHub API before they are processed by the agent.
[COMMAND_EXECUTION]: The skill makes extensive use of the host system's shell to perform development tasks.
Evidence: It executes various subcommands for git (worktree, fetch, commit), the GitHub CLI gh (view, edit, pr, api), and npm (run, install).
[EXTERNAL_DOWNLOADS]: The skill performs automated package installation which involves fetching resources from external registries.
Evidence: Step 2 explicitly calls for npm install within the new worktree to build the server environment. This is treated as safe as it targets the vendor's own repository structure.

pr-flow