The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is instructed to run arbitrary shell commands defined under the ## Body section of a repository's .tailrocks/pr.md file (e.g., Generator: cargo xtask ...). Since these commands are executed verbatim and the configuration file is part of the repository content, a malicious repository could execute unauthorized code.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository, including CONTRIBUTING.md, PR templates, and git history, to generate PR descriptions and commit messages. While the skill provides explicit instructions to the agent to treat this as 'evidence' rather than instructions, the attack surface remains present.
Ingestion points: .tailrocks/pr.md, .github/PULL_REQUEST_TEMPLATE.md, CONTRIBUTING.md, and git log output.
Boundary markers: The skill uses explicit 'Boundaries' in SKILL.md and a 'Runtime trust' policy in references/runtime-trust.md to warn the agent against following instructions embedded in repo data.
Capability inventory: Access to git, gh, arbitrary shell commands (via the generator), and a local helper script scripts/create-pr.ts.
Sanitization: The skill mandates the use of --body-file to prevent shell injection and instructs the agent to strip placeholders and instructions from generated content.
[DYNAMIC_EXECUTION]: The skill executes a bundled script (scripts/create-pr.ts) as a final gate. While the instructions claim this script implements a sandbox (network denied, limited writes), the skill still relies on executing this logic based on inputs derived from the untrusted repository environment.

tailrocks-create-pr