The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a significant attack surface for Indirect Prompt Injection because it makes decisions based on external, untrusted content from GitHub.
Ingestion points: The agent is instructed to read PR titles, branch names, and unresolved review threads using gh pr list and GraphQL queries (SKILL.md, Workflow Steps 2 & 3).
Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore or isolate potentially malicious instructions embedded in PR comments or metadata (Absent).
Capability inventory: The skill possesses high-impact capabilities including gh pr merge (with administrative bypass), git push to repository branches, and the ability to cancel or rerun GitHub Actions workflows (SKILL.md, Workflow Steps 4 & 5).
Sanitization: There is no evidence of filtering or validation of the text retrieved from GitHub before it influences the agent's logic for patching code or merging branches.
[COMMAND_EXECUTION]: The skill frequently uses the GitHub CLI (gh) and git to modify repository state. This includes Rule 10, which instructs the agent to use the --admin flag with gh pr merge to bypass branch policies if normal merging is blocked, which constitutes a high-privilege operation (SKILL.md, Rule 10).
[EXTERNAL_DOWNLOADS]: The skill fetches pull request data, workflow logs, and repository metadata from GitHub's official APIs. These operations target a well-known service (GitHub) and are consistent with the skill's documented purpose.

pr-merge-train