The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes shell execution blocks (syntax !command) to gather repository context when initialized. Several commands, including those for 'Base branch', 'Commits', and 'Diff stat', directly interpolate the user-provided argument '$1' into shell scripts. This implementation is vulnerable to command injection, as a crafted argument containing shell metacharacters could lead to arbitrary command execution on the host system at load time.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local repository that may contain malicious instructions. 1. Ingestion points: 'SKILL.md' reads repository data using 'git log', 'git diff', and local pull request templates. 2. Boundary markers: No delimiters or instructions are used to distinguish repository content from system instructions. 3. Capability inventory: The skill is authorized to run 'git push' and 'gh pr create' commands. 4. Sanitization: No escaping or validation is performed on the ingested repository content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill is designed to execute 'git' and 'gh' (GitHub CLI) commands to automate the pull request workflow. While functional, this capability can be abused if the agent is influenced by the command injection or prompt injection vulnerabilities identified above.

create-pr