The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it instructs the agent to ingest and act upon data from external, untrusted sources such as CI logs and pull request details. \n
Ingestion points: The skill uses gh run view --log-failed to retrieve failure logs and gh pr view to fetch pull request metadata (SKILL.md). \n
Capability inventory: The agent has the authority to modify source code, execute shell commands, perform git push to remote repositories, and schedule autonomous recurring tasks. \n
Boundary markers: No delimiters or safety instructions are provided to the agent to distinguish between its instructions and potentially malicious content within the logs. \n
Sanitization: There are no mechanisms described to sanitize or validate the external data before it is used to drive automated code changes. \n- [COMMAND_EXECUTION]: The skill establishes persistence by using the automation_update tool to schedule recurring tasks via cron. This creates an autonomous loop that can perform code modifications and git push operations independently of a user session, which could be influenced by malicious input.

fix-ci