The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and process external, untrusted data including pull request diffs, commit messages, and repository content.
Ingestion points: Untrusted data enters the agent context through git diff output and commit history extracted in resources/implementation-playbook.md.
Boundary markers: The skill lacks explicit boundary markers or delimiters when interpolating change summaries into the PR description templates.
Capability inventory: The skill uses subprocess.run to interact with the local filesystem via git. While the provided scripts do not perform network operations or direct file-writes, the agent's broad toolset could be leveraged if instructions are successfully injected.
Sanitization: There is no evidence of sanitization or filtering for the content of commit messages or code diffs before they are processed by the LLM.
[COMMAND_EXECUTION]: The PRAnalyzer class in resources/implementation-playbook.md uses subprocess.run to execute various git commands (rev-parse, diff). While it uses the list-based argument format which mitigates shell injection, it still represents a mechanism for system-level interaction based on potentially user-supplied branch names or commit SHAs.
[DYNAMIC_EXECUTION]: The Python snippets use __import__("os") to dynamically access environment variables within subprocess.run calls. While used here for the benign purpose of setting the locale (LC_ALL: C), dynamic imports can be a vector for loading unexpected modules if the input is manipulated.

git-pr-workflows-pr-enhance