The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from GitHub pull requests, including titles, bodies, diffs, and comments, which establishes a surface for indirect prompt injection attacks. * Ingestion points: The skill ingests data via gh pr list (metadata), gh pr checks (logs), gh pr diff (code changes), and PR comments. * Boundary markers: The instructions explicitly direct the agent to treat all PR-related content as untrusted data and strictly ignore any instructions contained within them. * Capability inventory: The skill has access to powerful tools for merging PRs (gh pr merge), committing and pushing code changes (git commit, git push), and managing CI runs (gh run cancel, gh run rerun). * Sanitization: The skill employs jq for structured data extraction and includes specific safety directives to handle content as data rather than instructions.
[COMMAND_EXECUTION]: The skill performs extensive shell command execution using git, gh, and jq with parameters derived from the local repository and external pull request metadata. * Evidence: Commands such as gh pr merge <number> <method>, gh run rerun <run-id>, and git branch -r --list "origin/$DEFAULT_BRANCH" utilize variables that could present a command injection risk if the underlying platform does not properly sanitize inputs.

merge-prs