The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by design, as it must ingest and process untrusted data from external GitHub contributors.
Ingestion points: The skill reads pull request metadata, CI check statuses, and reviewer comments in SKILL.md through tools like gh pr view and gh pr checks.
Boundary markers: There are no specific boundary markers or instructions provided to help the agent distinguish between legitimate technical feedback and malicious instructions hidden within PR comments (e.g., instructions to ignore safety rules or modify unrelated files).
Capability inventory: The skill has significant capabilities, including local file modification, git committing, and pushing changes to remote repositories.
Sanitization: The instructions lack any sanitization, filtering, or validation steps for content retrieved from external review comments before the agent acts upon it.
[COMMAND_EXECUTION]: The skill relies on executing shell commands to interact with the repository and GitHub services.
Evidence: The instructions direct the agent to use gh pr view, gh pr checks, and standard git commands for committing and pushing code. While these are necessary for the skill's function, they represent the execution of external CLI tools based on the state of the pull request.

shepherd