The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted data from GitHub CI logs and external reviewer comments, which represents an indirect prompt injection surface.
Ingestion points: Data enters the agent context in Step 8 via gh run view --log-failed for CI logs, and in Step 6.7 through subagent interaction with external review bot comments via implement-suggestion <pr> --watch.
Boundary markers: The skill explicitly scopes subagent prompts to ignore previous content and focus only on specific new external comments, and instructions require subagents to return highly structured data.
Capability inventory: The skill possesses significant capabilities, including executing shell commands (git, gh, timeout), writing code changes to the filesystem, and pushing commits to remote repositories.
Sanitization: Security is addressed through a "triage and summarize" pattern. The Step 8 triage subagent is strictly instructed to return only a 5-15 line error excerpt and a single-sentence suggested fix, explicitly forbidding the pasting of raw logs into the main agent context. This reduces the risk of malicious instructions in external data being executed by the primary agent.
[COMMAND_EXECUTION]: The skill makes extensive use of local shell commands to manage the git repository and GitHub integration.
Evidence: The skill utilizes git for branch management and gh for PR interactions. A specific polling script is defined in rules/registration-poll.md that executes a while loop via bash -c. These operations are well-defined, bounded by the timeout command, and align with the stated purpose of automating development workflows.

create-pr