The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs the gh-stack extension from the official GitHub repository (github/gh-stack). As this targets a well-known and trusted organization, the download is considered safe.
[COMMAND_EXECUTION]: The skill executes multiple command-line operations using git and gh. This includes creating worktrees, rebasing branches, and performing force-pushes (git push --force-with-lease). These operations are consistent with the skill's stated purpose of reorganizing branches and managing lockfiles via bundle lock and yarn install.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from GitHub (PR numbers, branch names, and file diffs). It includes a safety measure by filtering PRs to only those authored by app/dependabot, which significantly reduces the risk of processing malicious or attacker-controlled metadata from untrusted sources.

dependabot-stack