The Agent Skills Directory

[COMMAND_EXECUTION]: The skill automates several local CLI tools including git, ruff, mypy, pytest, and gh. These tools are used for standard software development tasks such as checking code quality and interacting with the GitHub API.
[COMMAND_EXECUTION]: The skill includes a helper script scripts/pr-summary.py that executes git commands via subprocess.run. The script employs shlex.split and avoids using the shell (shell=False), which is a secure method for handling user-supplied arguments (like branch names) and prevents shell command injection.
[COMMAND_EXECUTION]: The skill utilizes dynamic context injection in SKILL.md (!git log ...) to provide the agent with recent commit history at load time. This execution is static and restricted to reading git logs.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It ingests untrusted data in the form of git commit messages, which are then used by the agent to generate a PR summary. A malicious actor could craft a commit message containing instructions that attempt to override the agent's behavior during the summary generation phase.
Ingestion points: Git commit history accessed via scripts/pr-summary.py and displayed through dynamic context.
Boundary markers: None. Commit messages are parsed into JSON and passed directly to the agent for processing.
Capability inventory: The agent is granted access to the Bash, Read, and Grep tools, which could be misused if a prompt injection is successful.
Sanitization: No sanitization or content filtering is performed on the commit messages before they are processed by the agent.

pr