The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements an AI conflict resolution strategy where the agent is instructed to read, analyze, and resolve files containing git conflict markers. Because these files originate from external pull requests, an attacker could embed malicious instructions within the conflict zones to influence the agent's behavior.
Ingestion points: Conflicting file content is read into the agent's context as described in SKILL.md and references/ai-conflict-resolution.md.
Boundary markers: The skill does not implement explicit boundary markers or instructions to isolate untrusted code content from the agent's core instructions during the resolution process.
Capability inventory: The agent has access to the Edit tool to modify the filesystem and can execute git commands through the primary script's continuation mechanism.
Sanitization: There is no automated sanitization or validation of the untrusted code content before it is presented to the agent for analysis.
[COMMAND_EXECUTION]: The script scripts/backport.py executes various system commands using the subprocess module to interact with git and the GitHub CLI (gh).
Evidence: The script constructs command lists using user-influenced inputs like PR numbers, release versions, and branch names, passing them to subprocess.run via the run_gh and run_git helper functions.
Mitigation: The skill utilizes a 'mutation gate' (WRITE_PLAN/WRITE_APPROVAL) that forces the script to pause and wait for a specific approval token via stdin before executing any mutating command, ensuring user oversight.
[EXTERNAL_DOWNLOADS]: The conflict resolution process defined in references/ai-conflict-resolution.md includes a validation step that runs npx tsc --noEmit.
Evidence: The use of npx may trigger the download of the typescript package from the public npm registry if it is not already installed in the local environment.

rhdh-backport