The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and acts upon untrusted data from external sources.
Ingestion points: Data is ingested via gh issue view, gh pr view, git log, git diff, and through the reading of conflicted file contents as described in SKILL.md.
Boundary markers: Absent. The skill provides no instructions to the agent to treat external data as untrusted or to ignore embedded instructions within processed files or issues.
Capability inventory: The agent is authorized to execute complex commands (git, pnpm, cargo, gh), perform network operations (git push, gh issue create), and modify local files.
Sanitization: There is no evidence of sanitization or validation of the content retrieved from external sources before it is interpreted by the agent.
[COMMAND_EXECUTION]: The skill incorporates user-provided input (<pr-number>) and potentially untrusted project configuration (build system commands like pnpm or cargo) into shell commands.
Command Injection Surface: The use of the <pr-number> placeholder directly in shell commands like gh pr view <pr-number> represents a potential injection vector if the input is not strictly validated by the agent as a numeric identifier.
Dynamic Build Commands: The skill instructs the agent to run project-specific check commands (e.g., pnpm typecheck, cargo test) on code that has been modified during the conflict resolution process, which could lead to arbitrary code execution if the merged code contains malicious build-time scripts.

oh-conflict