The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources that could contain malicious instructions designed to influence the agent's behavior during the pull request creation process.
Ingestion points: Reads AGENTS.md, contribution requirements, and pull request templates from both local and remote (GitHub owner's .github repository) locations.
Capability inventory: The skill uses gh pr create and gh pr edit to perform write operations to the repository.
Boundary markers: The instructions do not specify the use of delimiters or specific warnings to ignore instructions embedded within the processed templates.
Sanitization: There is no mention of sanitizing or escaping the content of the fetched templates before using them to construct the PR body.
[COMMAND_EXECUTION]: The skill uses the GitHub CLI (gh) to perform repository operations. While these are the primary purpose of the skill, they represent an execution capability that could be targeted by injected instructions.
Evidence: Use of gh pr create and gh pr edit with arguments derived from external templates and user-controlled branches.

create-pr