The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from existing GitHub PR bodies and user-editable temporary files, creating a potential surface for indirect prompt injection.
Ingestion points: Reads existing PR bodies and comment strings (SKILL.md), and parses user-supplied input.json artifacts (artifact-paths.md).
Boundary markers: The instructions mandate byte-for-byte Markdown preservation checks and the use of explicit verification receipts to detect unintended modifications.
Capability inventory: The skill uses the GitHub CLI (gh), browser automation tools (Playwright/CDP), and file system write operations across various scripts.
Sanitization: Implements mandatory redaction of secrets (JWTs, tokens, signed parameters) from all displayed outputs and logs. It also verifies that uploaded objects are valid decodable images.
[REMOTE_CODE_EXECUTION]: The skill automates the installation and execution of a GitHub CLI extension (gh-attach). It mitigates risk by implementing a trust model that requires explicit user choice and authorization before executing or installing unreviewed upstream versions, while promoting a pinned, reviewed fork from the vendor.
[COMMAND_EXECUTION]: The skill executes shell commands using the GitHub CLI (gh) and browser automation frameworks (Playwright) to interact with the GitHub API and web interface. These operations are scoped to the skill's primary function but involve executing external binaries.
[EXTERNAL_DOWNLOADS]: The skill fetches external code by installing GitHub CLI extensions and potentially downloading browser drivers for Playwright. The skill provides clear provenance classification (reviewed-fork, reviewed-upstream, etc.) to manage the supply chain risk associated with these downloads.

tk-pr-image