The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by ingesting and acting upon untrusted data from external sources.
Ingestion points: The skill fetches GitHub PR comments (repos/$REPO/pulls/$PR_NUM/comments) and issue reactions (repos/$REPO/issues/$PR_NUM/reactions) using gh api --paginate in SKILL.md.
Boundary markers: No explicit boundary markers or system instructions are defined to separate the fetched comment content from the agent's instructions, nor are there warnings to ignore commands embedded within those comments.
Capability inventory: The skill possesses high-privilege capabilities including modifying local source code (repair phase), pushing changes to the repository, and merging pull requests.
Sanitization: The instructions do not include any steps to sanitize or validate the content of the comments before they are used to determine the agent's repair and merge logic.

pr-autoloop