The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The preflight check in SKILL.md (Step 4) reads the file $HOME/.codex/auth.json using jq to verify the presence of access_token, refresh_token, and account_id. Accessing credential-bearing files is a high-risk operation.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted content from GitHub Pull Requests and Issues.
Ingestion points: Data enters the system when the gator agent is launched to "Review and monitor" specific PRs or Issues.
Boundary markers: The instructions include scoping directives such as "Scope this invocation only to PR #${pr_number}", which serve as soft boundaries but do not prevent malicious instruction obedience.
Capability inventory: The skill executes shell scripts (./scripts/agents/run.sh), uses the GitHub CLI (gh api), and writes log files to the local file system.
Sanitization: The skill employs regex validation ([[ "$pr_number" =~ ^[0-9]+$ ]]) to ensure that inputs like PR numbers and gateway names are normalized before being used in shell commands, which mitigates direct command injection but does not prevent indirect prompt injection within the agent's logic.

launch-openshell-gator