The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses the GitHub CLI (gh) and the GitHub API to automate PR workflows.
Evidence includes commands like gh pr view, gh pr checks, and gh api for reactions and comments.
It includes logic to execute a squash merge once predefined safety conditions are met.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and acts upon untrusted data from an external source (GitHub PR comments).
Ingestion points: The skill fetches PR comments via gh api --paginate "repos/$REPO/pulls/$PR_NUM/comments" in the SKILL.md file.
Boundary markers: There are no explicit boundary markers or instructions provided to the agent to disregard potentially malicious instructions embedded within the fetched comments.
Capability inventory: The agent possesses high-impact capabilities, including the ability to modify the local worktree for "repairs", push code to the remote repository, and perform a gh pr merge operation.
Sanitization: The skill lacks sanitization or validation logic to filter the content of the comments, relying only on the presence of specific "badges" (P1/P2) which could be spoofed by a malicious actor.

pr-autoloop