The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from repository history, diffs, and existing GitHub pull request bodies to generate new PR descriptions. This surface could be exploited by an attacker who places malicious instructions in commit messages or existing PR metadata.\n
Ingestion points: Content gathered via git diff, git log, gh pr view, and pull request templates found in .github/PULL_REQUEST_TEMPLATE/.\n
Boundary markers: The skill explicitly uses quoted heredoc sentinels (e.g., '__PR_BODY_END__') in SKILL.md when writing to temporary files to ensure that generated content is treated as literal data and does not trigger shell expansion during CLI execution.\n
Capability inventory: The skill is capable of executing git commit, git push, gh pr create, and gh pr edit, which allows it to modify the repository and its metadata.\n
Sanitization: Although shell execution is hardened against command injection, the skill lacks explicit sanitization for natural language inputs derived from untrusted repository sources before they are processed for description generation.\n- [COMMAND_EXECUTION]: The skill makes extensive use of git and gh (GitHub CLI) commands to interact with the repository and remote host. It includes specific guidance for escaping special characters in titles and handles multi-line input through shell subshells.\n- [DYNAMIC_EXECUTION]: The skill dynamically manages PR body content by creating temporary files at runtime using mktemp and heredocs. This method is used to pass content to the GitHub CLI safely without exposing it to the risks of direct shell expansion.

open-pr