The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external PRs, including head/base repositories, review threads, and check states. This creates a surface where malicious instructions embedded in a PR description or a review comment could potentially influence the agent's logic during the rebase or verification process.
Ingestion points: The skill fresh-reads repository metadata, PR numbers, head/base SHA values, and review thread content from GitHub at the start of its workflow.
Boundary markers: There are no explicit instructions or delimiters defined to separate untrusted PR data from the agent's core instructions.
Capability inventory: The skill has broad capabilities including file system access (worktree creation), command execution (git rebase, git push), and network interaction (GitHub API for reviews and PR updates).
Sanitization: There are no documented steps for escaping or validating the content retrieved from GitHub review threads before processing.
[COMMAND_EXECUTION]: The skill performs sensitive Git operations that mutate the repository state and affect remote history.
Evidence: The instructions explicitly authorize the use of git rebase and git push --force-with-lease. While the skill includes safety checks (refspec validation), these commands remain high-impact operations.
[DATA_EXPOSURE]: The skill accesses environment variables and sensitive local Git configuration to verify workspace provenance.
Evidence: The skill inspects GIT_DIR, GIT_COMMON, and the output of git rev-parse --show-superproject-working-tree to determine isolation boundaries. While used for safety checks, this involves reading the local environment configuration.

tk-pr-rebase