The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes git and the GitHub CLI (gh) to read repository state and perform merge operations. These actions are restricted to standard, non-privileged repository management tasks.
[EXTERNAL_DOWNLOADS]: The workflow provides instructions to install the ready-pr skill using pnpm dlx skills@latest. This command downloads and executes a package from the registry to handle skill dependencies. The instruction includes the npm_config_ignore_scripts=true flag as a security precaution to prevent the execution of arbitrary lifecycle scripts during installation.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from GitHub pull requests which could potentially contain malicious content.
Ingestion points: Pull request metadata (state, head branch, commit SHA, review decision, and check status) is retrieved from GitHub via gh pr view in workflows/enable-auto-merge.md.
Boundary markers: The workflow logic is driven by specific, structured JSON properties from the CLI tool rather than natural language interpretation of pull request bodies or comments.
Capability inventory: The skill has the ability to merge pull requests and install additional software packages.
Sanitization: The skill uses the --match-head-commit flag as an optimistic concurrency guard to ensure the merge only occurs if the PR head exactly matches the verified state, effectively preventing race conditions or injections that modify the PR between the verification and execution steps.

merge-pr