The Agent Skills Directory

[PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface because its core logic involves reading and following instructions from untrusted external sources.
Ingestion points: The agent is instructed to read live GitHub issue bodies and comments via gh issue view and repository-level instruction files such as AGENTS.md and contribution docs via read_file (Step 1).
Boundary markers: Absent; there are no instructions for the agent to use delimiters or to treat the retrieved content as untrusted data.
Capability inventory: The agent has high-privilege capabilities including terminal access for arbitrary shell commands, gh CLI for repository/PR management, and broad file system access.
Sanitization: Absent; the agent is explicitly directed to use the retrieved content to determine the "currently requested behavior".
[COMMAND_EXECUTION]: The skill directs the agent to execute "canonical test entrypoints" and quality gates defined within the repository (Step 7). This constitutes execution of code provided by the target codebase, which is a standard functional risk for autonomous coding agents.
[SAFE]: The skill enforces several security-positive development practices, such as performing a 'sabotage run' to verify that regression tests actually fail without the fix, and checking git log to ensure proposed changes do not conflict with original design intent.
[NO_CODE]: This skill consists entirely of markdown instructions and does not bundle any executable scripts or binary files.

github-issue-to-pr