The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, specifically GitHub Pull Request descriptions, comments, and review threads. This creates a surface where malicious instructions embedded in PR content could attempt to influence the agent's triaging logic or planned responses.
Ingestion points: The scripts/triage.mjs script fetches PR bodies, comments, and CI logs via the GitHub API to determine actionable items.
Boundary markers: SKILL.md defines a 'Retrieved Evidence Boundary' that explicitly warns the agent that instruction-like text inside external content cannot change the skill's protocol or approved scope.
Capability inventory: The skill uses the GitHub CLI and Git to manage PR states and plans work for other skills that may modify code.
Sanitization: The triage script performs basic normalization and noise removal (e.g., stripping HTML comments and details tags), but the primary defense is the 'Batch Approval' checkpoint which requires the user to explicitly approve any planned mutations or publication scope.
[COMMAND_EXECUTION]: The skill executes shell commands using the gh (GitHub CLI) and git binaries to retrieve repository state and interact with the GitHub API. These executions are managed via node:child_process.execFileSync in the scripts/triage.mjs script, which passes arguments as a discrete array to prevent command injection.
[EXTERNAL_DOWNLOADS]: The skill interacts with the GitHub API to fetch pull request metadata and CI check results. These network operations are conducted through the official GitHub CLI and target a well-known service, facilitating the skill's core functionality of repository management.

tk-pr-sweep