The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the load-time execution pattern in the SKILL.md file to populate project context (e.g., git status, pwd, git branch). These commands are used for status retrieval and are considered benign in this implementation.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external GitHub PR metadata, which could contain malicious instructions designed to influence the agent's behavior during the merge or reporting process.
Ingestion points: External data enters the agent context via the Context section in SKILL.md which calls gh pr view.
Boundary markers: Absent; there are no specific delimiters or instructions to the agent to ignore potentially malicious content within the PR metadata.
Capability inventory: The skill has access to Bash(git *) and Bash(gh *) as defined in the allowed-tools frontmatter.
Sanitization: Absent; the skill directly interpolates values extracted from tool outputs into its workflow.
[COMMAND_EXECUTION]: The skill executes multiple bash commands to perform its core functions. This includes potentially destructive operations like git worktree remove --force and git branch -D. While these are legitimate parts of the skill's workflow, they are executed based on variables extracted from the environment and external PR data.

wt-merge