The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses git and gh CLI tools to synchronize branches and create pull requests. These are standard operations for a development skill. Specifically, it executes git fetch, git merge, and gh pr create using explicit arguments derived from repository metadata.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data—specifically git commit messages, branch names, repository issue trackers, and PR templates—to construct a pull request body. This represents an attack surface where malicious data in a commit message or issue description could attempt to influence the agent's behavior during the 'Build the PR body' phase.
Ingestion points: Reads data from git branch -r, git diff, commit history (origin/<base-branch>...HEAD), and repository files like pull_request_template.md or .github/PULL_REQUEST_TEMPLATE/.
Boundary markers: The skill uses a temporary file (--body-file) to handle the PR content rather than passing it directly as a shell argument, which mitigates simple command injection but does not isolate the LLM from the content itself.
Capability inventory: The skill has the capability to execute shell commands (git, gh) and write to the filesystem (creating the PR body file).
Sanitization: The instructions explicitly warn the agent to 'never invent an issue number' and to 'resolve issue relationships from evidence,' which provides a behavioral constraint against hallucination or obedience to injected instructions, though it lacks technical sanitization (e.g., escaping markdown).

open-pr