The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub PRs and issues to drive maintainer workflows, which presents an attack surface for indirect prompt injection.
Ingestion points: PR titles, bodies, and comments are retrieved via gh pr view and gh issue view (SKILL.md).
Boundary markers: No explicit boundary markers or instructions to treat external data as untrusted are present in the skill's instructions.
Capability inventory: The agent can execute gh CLI commands to comment, label, or close PRs, and bun to execute local scripts (SKILL.md).
Sanitization: There are no documented steps for sanitizing external PR content before it is processed by the agent.
[DYNAMIC_EXECUTION]: The skill requires the agent to generate and execute local Playwright test scripts based on requirements found in pull requests.
Evidence: The agent is directed to "Write a temporary Playwright scenario" and execute it using bun run proof:ui (SKILL.md).
Risk: A malicious contributor could craft a PR description designed to trick the agent into generating and running a script with harmful local side effects.
[COMMAND_EXECUTION]: The skill employs standard command-line tools to manage repository state and execute project-specific workflows.
Evidence: Uses gh for GitHub API interactions and bun for local testing and publishing of proof artifacts (SKILL.md).
Context: These tools are used for maintainer operations within the openclaw/clawhub repository.

clawhub-pr-maintainer