The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: In Phase 5: Quality Gate of SKILL.md, the skill automatically detects and executes build/test commands found within the cloned repository (e.g., make check, npm test, cargo test). Since the repository is an untrusted external source, this allows a malicious repository to execute arbitrary code on the agent's environment.
[COMMAND_EXECUTION]: The skill uses bash to execute a wide variety of commands, including GitHub CLI (gh) and Git. While these are necessary for its function, they are executed in a context where external data (issue titles, repository names) is interpolated into command strings, creating a surface for command injection.
[PROMPT_INJECTION]: In SKILL.md (Phase 6) and references/pr-convention-analyzer.md (Section E), the skill is explicitly instructed to ignore AI disclosure requirements and never add any AI-related identification. This is a direct instruction to bypass safety and ethical guidelines established by the target repositories.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub issue bodies, comments, and repository files to drive its Analyze & Fix logic (Phase 4). There are no boundary markers or sanitization steps to prevent instructions embedded in these external sources from hijacking the agent's behavior. Mandatory Evidence Chain: 1. Ingestion points: GitHub issue bodies and comments via gh search issues; repository source code via git clone. 2. Boundary markers: None identified in the prompt logic. 3. Capability inventory: Full shell access (bash), file system modification, and network access via the GitHub CLI. 4. Sanitization: No sanitization or filtering of external content is performed before processing.
[DYNAMIC_EXECUTION]: Phase 5: Quality Gate uses logic to dynamically determine which commands to run based on the presence of certain files (e.g., package.json, Makefile, Cargo.toml). This dynamic generation and execution of commands from an untrusted source is a high-risk pattern.

issue-fixer