The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub pull requests, creating an attack surface for instructions embedded in PR titles, bodies, or patches.
Ingestion points: The agent fetches data via gh pr list (titles and metadata), gh pr view (PR body/release notes), and gh pr diff (patch content) as described in SKILL.md (Steps 2, 4, and 7).
Boundary markers: There are no explicit instructions or delimiters provided to the agent to ignore or isolate instructions that might be contained within the pull request data.
Capability inventory: The agent has the capability to write files via git apply and direct edits (Step 5), and to execute arbitrary shell commands via local build tools like ./mvnw, ./gradlew, and npm test (Steps 6 and 7).
Sanitization: No sanitization or validation of the external content is performed before the agent processes it to resolve conflicts or update configurations.
[COMMAND_EXECUTION]: The skill executes various system commands and local scripts to perform its tasks.
Evidence: Instructions in SKILL.md direct the agent to run git (fetch, apply, reset, grep), gh (list, view, diff, api), and project-specific wrappers such as ./mvnw and ./gradlew.
[DYNAMIC_EXECUTION]: The skill executes build and test scripts found within the repository's working tree to verify the combined upgrades.
Evidence: Step 7 in SKILL.md instructs the agent to run ./mvnw verify, ./gradlew build, or npm test. These scripts are part of the local environment and are executed to build and test code that has been modified by external patches.
[EXTERNAL_DOWNLOADS]: The skill fetches content from external sources, specifically GitHub.
Evidence: Step 4 uses gh pr diff <number> --patch to download patch files from GitHub's servers to the local /tmp directory. As GitHub is a well-known service, this is documented as a standard operation for the skill's purpose.

apply-renovate-prs