The Agent Skills Directory

[PROMPT_INJECTION]: The skill is subject to indirect prompt injection through its processing of untrusted external data. This includes pull request descriptions, comments, and issue references retrieved via the gh tool, as well as external specifications fetched using WebFetch.
Ingestion points: Data enters the context from gh pr view output (body, comments, reviews) and external URLs via WebFetch.
Boundary markers: Absent. The instructions do not define clear delimiters or use "ignore embedded instructions" warnings for data coming from PRs or external documentation.
Capability inventory: The agent has permissions to write and edit files, execute shell commands (git, gh, uv), and perform network operations (WebFetch).
Sanitization: Absent. There is no specified logic for sanitizing or validating ingested data before it is used to inform code changes or execution plans.
[COMMAND_EXECUTION]: The skill uses several powerful command-line tools including git, gh, and uv. While these are appropriate for the intended developer workflow, they provide a significant capability surface that could be exploited if the agent is manipulated by malicious content within a pull request.
[EXTERNAL_DOWNLOADS]: The WebFetch tool is explicitly used to research external specifications and provider documentation. This involves fetching content from remote URLs, which could lead to the ingestion of malicious content if the URLs are provided by untrusted sources in a pull request or issue.

complete-partial-pr