The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes dynamic context injection (!command) to gather repository information (e.g., repository name, branch status, commit logs, and diffs). Several of these commands directly interpolate the $ARGUMENTS variable or positional parameters (e.g., ${1}) into shell command strings. This creates a risk of command injection if a user provides input containing shell metacharacters such as semicolons, pipes, or backticks.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It ingests untrusted data from the local environment, including commit messages, file diffs, and the contents of .github/pull_request_template.md. Malicious instructions embedded within these sources could potentially influence the LLM to generate misleading PR titles or bodies, or to ignore specific instructions during the composition phase.
[COMMAND_EXECUTION]: The skill is configured to 'Execute immediately without asking,' performing actions like git push and gh pr create automatically. This lack of a human-in-the-loop checkpoint increases the impact of the aforementioned injection risks, as malicious actions or content could be pushed to the remote repository without review.

make-pr