The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its handling of untrusted data from git diffs.
Ingestion points: The skill ingests git diff content during the clean step (to remove dead code/debug logs) and the pr-update step (to generate titles and bodies).
Boundary markers: There are no instructions to the agent to treat diff content as data only or to ignore instructions embedded within code comments or string literals in the diff.
Capability inventory: The skill has the capability to modify the local file system (via the clean sub-task) and perform network operations on git forges (via the pr-update sub-task).
Sanitization: The skill does not define any sanitization, filtering, or escaping of the diff content before it is processed by the agent.

cpr