The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and act upon natural language triggers and obligations defined in the repository's root guidance files (CLAUDE.md or AGENTS.md).
Ingestion points: The skill ingests untrusted content from the root-level CLAUDE.md or AGENTS.md files during the 'Post-merge triggers' step (Step 4).
Boundary markers: There are no explicit boundary markers or instructions provided to the agent to disregard malicious or conflicting instructions embedded within these files.
Capability inventory: The skill has the capability to merge PRs, close issues, and create new issues in external repositories using the gh CLI tool.
Sanitization: The skill does not describe any sanitization or validation of the triggers or the 'things to do' instructions retrieved from the guidance files, which could lead to the agent performing unauthorized actions if the file is maliciously modified.
[COMMAND_EXECUTION]: The skill constructs shell commands using the GitHub CLI (gh) and Git, incorporating variables such as PR numbers, branch names, and run IDs.
Evidence: The 'Gate' and 'Merge' steps use variables like <PR>, <branch>, and <run> directly in shell command templates (e.g., gh pr update-branch <PR>, gh run watch <run>). If these metadata fields contain malicious characters and the execution environment does not provide automatic escaping, it could lead to command injection.

land-ticket