The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local shell commands to interact with the git repository and the GitHub CLI (gh). It executes commands such as git fetch, git log, and git diff to gather branch metadata. While the skill is designed to be read-only during the inspection phase, it generates actionable (and potentially destructive) commands like git branch -D or git push origin --delete for the user to run. The skill instructions mandate that the agent must not execute these commands automatically and must seek explicit user confirmation if asked to do so.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). It ingests untrusted data from the repository's history and source code.
Ingestion points: The skill reads commit messages via git log and code changes via git diff (as specified in SKILL.md and references/overview-fields.md).
Boundary markers: There are no explicit instructions to the agent to treat content within diffs or commit messages as untrusted or to ignore embedded instructions.
Capability inventory: The agent has the capability to generate shell commands and suggest PR titles/bodies based on its analysis of the ingested data.
Sanitization: No sanitization or validation of the commit messages or diff content is performed before processing. A malicious actor could craft commit messages or code comments designed to mislead the agent into recommending a specific action (e.g., 'keep' an abandoned branch) or influencing the content of a generated Pull Request.

branch-inspector