The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data and uses write-capable tools to interact with a third-party platform, creating an attack surface for indirect instructions.
Ingestion points: The skill reads PR titles, existing descriptions, git logs (git log main..HEAD --oneline), and git diffs (git diff main..HEAD). These sources are populated by potentially untrusted external contributors.
Boundary markers: The instructions do not define delimiters or specific safety prompts to ensure the agent ignores natural language instructions that might be embedded within the code diffs or commit messages it analyzes.
Capability inventory: The agent is authorized to use a GitHub plugin to update PR descriptions and execute local git commands, providing a path for injected instructions to result in unauthorized repository modifications.
Sanitization: There is no evidence of filtering or sanitization of the content extracted from the git history before it is passed to the LLM for analysis.
[COMMAND_EXECUTION]: The skill executes local shell commands to gather context about the repository state.
Evidence: Uses git log main..HEAD --oneline to retrieve commit summaries and git diff main..HEAD to retrieve code changes.

pr-description