The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub pull request descriptions to extract test specifications.
Ingestion points: The run operation reads the PR body using gh pr view or mcp__github__pull_request_read (found in rules/runner.md).
Boundary markers: The skill relies on HTML comment markers  and  to isolate the spec (defined in rules/spec-format.md).
Capability inventory: The skill has the ability to write to the file system, execute GitHub CLI commands, and dispatch sub-agents (aw-tester) as described in rules/runner.md.
Sanitization: While the skill extracts content based on markers, the content within those markers is treated as a domain-specific language for testing, which could be manipulated by a malicious PR author to influence the behavior of the testing sub-agent.
[DYNAMIC_EXECUTION]: The skill dynamically generates configuration and specification files at runtime.
Evidence: In rules/runner.md, Step 3 describes materializing specs.md and aw-target.yml under an ephemeral .agent/{branch}/.preview-spec/ directory. These files are generated from templates and PR data to be consumed by the aw-tester runner.
[COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (gh) to perform various metadata operations.
Evidence: rules/preview-url-resolution.md details the use of gh api to fetch deployment and status information from GitHub's official repositories API. These commands are part of the intended functionality for resolving preview URLs.

preview-spec