The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources to build pull request descriptions.
Ingestion points: The agent is instructed to read the 'final diff', 'commits', and 'the issue the change closes' (SKILL.md, Section 1: Gather).
Boundary markers: There are no explicit instructions to use delimiters or ignore embedded instructions within the ingested data, increasing the risk that malicious text in a Git diff or issue description could influence the agent's behavior.
Capability inventory: The agent has access to the gh CLI and is encouraged to perform verification runs (SKILL.md, Sections 1 and 4).
Sanitization: The 'Verify' step (SKILL.md, Section 3) employs a 'fresh agent' to check for data exposure and unsupported claims, which serves as a significant security control against both hallucination and malicious data.
[COMMAND_EXECUTION]: The skill instructs the agent to execute verification actions based on the state of the code.
Evidence: The 'Gather' section mentions 'Run: a command or action you ran on the final state, with its output' as a source for the claims list. If an attacker controls the 'issue' or 'documentation' that suggests these verification steps, they might attempt to trick the agent into running malicious commands under the guise of verification checks.

pr-description