The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub, specifically pull request titles, bodies, and review comments. This content is used to inform code changes and merge commit messages, which represents a potential attack surface.
Ingestion points: PR metadata is fetched in SKILL.md via gh pr view, and review comments are retrieved in land_watch.py using gh api calls.
Boundary markers: The skill includes a "context guard" instruction in SKILL.md (Step 10) requiring the agent to verify review feedback against the user's stated intent before implementation.
Capability inventory: The skill has the capability to modify repository files (via referenced commit and push skills) and perform merge operations.
Sanitization: The Python helper script land_watch.py includes a sanitize_terminal_output function to strip control characters from output, but it does not perform explicit sanitization of natural language instructions within the ingested PR data.
[COMMAND_EXECUTION]: The skill and its helper script execute the GitHub CLI (gh) to automate pull request management.
Subprocess implementation: The script land_watch.py uses asyncio.create_subprocess_exec to execute commands with arguments passed as a list, which is a secure method that avoids shell injection vulnerabilities.

land