The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection or command injection because it directly interpolates the $ARGUMENTS (PR number) into shell commands without sanitization.
Ingestion points: The $PR_NUMBER variable is derived from user-supplied $ARGUMENTS in SKILL.md.
Boundary markers: There are no delimiters or instructions to treat the input as literal data rather than executable shell parameters.
Capability inventory: The skill executes shell commands using the gh CLI (e.g., gh pr view $PR_NUMBER).
Sanitization: No input validation, escaping, or filtering is performed on the $PR_NUMBER variable before it is used in the command line.
[COMMAND_EXECUTION]: The skill uses the gh command-line tool to interact with GitHub. While gh is a standard tool, the lack of input validation mentioned above allows for the execution of arbitrary commands if a malicious PR number (e.g., 97; rm -rf /) is provided.

await-ci