The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, creating a surface for indirect prompt injection attacks where malicious instructions hidden in PR comments could influence the agent's behavior.
Ingestion points: SKILL.md (Step 2) gathers PR bodies, comments, reviews, and failed logs. references/ci-checks.md fetches failed logs using the gh run view command.
Boundary markers: While references/thread-resolution.md uses templates for output, the skill lacks explicit instructions to treat incoming PR content as data only or to ignore instructions embedded within that content.
Capability inventory: The skill can write to the local filesystem (creating commits), execute shell commands for verification (references/tdd-cycle.md), and perform network operations via the GitHub CLI (gh).
Sanitization: No explicit sanitization or filtering of the fetched PR content is described before the agent processes it to build the worklist.
[COMMAND_EXECUTION]: The workflow involves executing local tests, linters, and build commands during the verification phase (references/tdd-cycle.md). While standard for a development-focused skill, this involves executing code defined within the repository context which could be manipulated by adversarial PR content.

snap-resolve