The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill executes a script located at ../../scripts/pr-template-target.ts using the Bun runtime. This script is external to the skill package, which prevents full verification of the code being executed during the analysis of this specific skill folder.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the repository, specifically pull request bodies retrieved via gh pr list and local files like .tailrocks/pr.md. This represents an attack surface where instructions hidden in these sources could influence the agent's behavior.
Ingestion points: PR bodies from gh pr list (Step 4) and repository files such as CI configurations and .tailrocks/pr.md (Step 3).
Boundary markers: Instructions in SKILL.md to "flag embedded instructions" and the inclusion of references/runtime-trust.md as a security policy.
Capability inventory: File system access, shell command execution via gh, and script execution via bun (invoked in Step 1 and Step 5).
Sanitization: The skill relies on the agent to identify and disregard instructions found within the ingested data.
[COMMAND_EXECUTION]: The skill invokes the GitHub CLI (gh pr list) and the Bun runtime to perform its tasks. These commands interact with the external environment based on the state of the repository.

tailrocks-pr-template