The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell scripts (pr-state.sh, pr-final.sh) and common developer tools like git, gh (GitHub CLI), and jq. It performs tasks such as managing git worktrees, fetching branches, and pushing code to remote repositories.
[INDIRECT_PROMPT_INJECTION]: The skill is instructed to read pull request comments and CI logs to diagnose and fix issues, which exposes it to indirect prompt injection attacks. Malicious instructions could be placed in these untrusted external sources to manipulate the agent's behavior.
Ingestion points: Ingestion occurs through gh pr view (retrieving comments) and gh run view --log-failed (retrieving CI logs) as specified in SKILL.md and pr-state.sh.
Boundary markers: No boundary markers or 'ignore' instructions are present to mitigate the risk of the agent following instructions embedded in the external data.
Capability inventory: The skill possesses extensive capabilities, including file system writes, shell command execution, and the ability to commit and push changes to code repositories.
Sanitization: There is no evidence of sanitization or validation of the content retrieved from external comments or logs before it is processed by the agent.

pr-ready