The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes the GitHub CLI (gh) via Node.js child_process.spawnSync to retrieve pull request metadata, status checks, and mergeability information.
[EXTERNAL_DOWNLOADS]: The skill interacts with the Paperclip API using the node:fetch API to search for issues and post status updates. It correctly handles credentials through environment variables (PAPERCLIP_API_KEY).
[DATA_EXFILTRATION]: While the skill transfers data between GitHub and the Paperclip API, all operations are performed within the expected context of the vendor's own infrastructure and are consistent with the primary purpose of 'PR Gardening'.
[PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection as it ingests untrusted content from GitHub pull request titles and comments (Ingestion points: gh pr view output, Paperclip issue search). However, it mitigates this risk by explicitly instructing the agent to use programmatic scripts for discovery and analysis rather than LLM reasoning, and it uses specific HTML markers for tracking state (Boundary markers: ). The skill has access to shell execution and network tools (Capability inventory: gh CLI, fetch via Node.js), but applies normalization and regex validation to inputs (Sanitization: normalizeRepository, extractPullRequestNumber).

pr-gardening