The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses git and gh CLI commands to perform high-privilege actions including merging PRs, pushing commits to remote repositories, and deleting branches. While the code utilizes argument arrays to prevent shell injection, the operational capabilities are significant.
[COMMAND_EXECUTION]: The finalize-run.js and gate-check.js scripts include bypass flags such as --skip-review and --force-finalize-nonready. These mechanisms allow the agent to intentionally circumvent the required LGTM audit trail, creating a path for merging unreviewed code if the agent is manipulated or safety constraints are bypassed.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection. It parses external GitHub PR comments and bodies to determine the state of a run and search for 'LGTM' or 'Verdict' markers. An attacker who can comment on the PR could attempt to inject content designed to spoof the verification logic, although this is partially mitigated by checks for the authorized reviewer's login.
[COMMAND_EXECUTION]: The skill performs file system modifications, specifically appending 'learnings' to spec/capabilities.md and moving files in the backlog directory. While it uses structural markers to bound its writes, this capability represents an automated modification of repository documentation based on run outcomes.

relay-merge