The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests untrusted data from external sources.
Ingestion points: The skill instructions in SKILL.md require the agent to read CI logs and pull request diffs, which can be influenced by external contributors.
Boundary markers: The instructions do not specify explicit delimiters or 'ignore' instructions for the untrusted log content.
Capability inventory: The agent is granted permissions to post PR comments (pull-requests: write) and can be configured to commit directly to the repository (contents: write).
Sanitization: The 'Verify-Before-Persist' rule acts as a primary safeguard, ensuring that a patch is only considered 'verified' if it allows the failing CI check to pass upon re-execution.
[EXTERNAL_DOWNLOADS]: The skill documentation and workflow examples reference the installation of the gh-aw extension from githubnext/gh-aw. This is a recognized organization (GitHub Next) providing legitimate developer tools.
[COMMAND_EXECUTION]: The workflow examples in references/workflow-example.md include shell commands for applying patches (git apply) and running local verification scripts. These commands are executed within the controlled environment of a CI runner.
[CREDENTIALS_UNSAFE]: The skill follows security best practices by using GitHub Secrets (secrets.GITHUB_TOKEN, secrets.HEAL_PUSH_TOKEN) to manage sensitive access tokens, rather than hardcoding credentials.

self-healing-ci