The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the gh CLI and curl to interact with GitHub's REST API. The github spoke specifically allows for raw CLI queries, which could be misused to execute unauthorized operations if user input is not properly sanitized.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8). It ingests untrusted data from GitHub issues, pull requests, and review comments. This external content could contain malicious instructions designed to influence the behavior of the orchestrator or the sub-agents it spawns to 'auto-fix' bugs.
Ingestion points: Processes content from external GitHub issues (gh-issues) and pull request reviews (review-pr).
Boundary markers: The prompt lacks explicit delimiters or instructions to ignore embedded commands within the processed issue/PR text.
Capability inventory: Possesses capabilities to write to the file system (.local/ artifacts), execute shell commands (gh, curl), and modify remote repositories (push, merge).
Sanitization: No evidence of sanitization or validation of the external content before it is processed by the agent or passed to sub-agents.
[REMOTE_CODE_EXECUTION]: The skill uses dynamic loading of specialist skills from computed paths: ~/.agents/skill-clusters/skills/<spoke-name>/SKILL.md. If the spoke-name is influenced by untrusted input without strict allow-listing, it could lead to path traversal or the loading of unintended files from the local system.

git-pr-ops-orchestrator