The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from pull request titles, bodies, and comments. Ingestion points: The agent gathers pull request data via gh pr view and reads repository configuration from .tailrocks/pr.md and .github/PULL_REQUEST_TEMPLATE.md. Boundary markers: The instructions explicitly direct the agent to treat PR content as evidence rather than instructions and to flag any embedded instructions detected in the data. Capability inventory: The skill has the capability to execute shell commands via git and gh, and it possesses write authority to modify pull request titles and bodies. Sanitization: The instructions mandate the use of the --body-file flag and direct argument passing for the gh pr edit command to mitigate shell interpolation and argument injection risks.
[DYNAMIC_EXECUTION]: The skill is instructed to execute a command specified in a repository configuration file, which introduces a risk of arbitrary code execution from untrusted sources. Evidence: Step 2 of the skill instructions states the agent should "run the conventions file's body generator when one is named" in the .tailrocks/pr.md file. Risk: Because the command to be executed is read from a file within the repository, a malicious contributor could define a dangerous command that the agent would execute in the user's environment.
[COMMAND_EXECUTION]: The skill relies on executing various shell commands to interact with the Git repository and the GitHub CLI. Evidence: The skill frequently uses tools like gh pr view, gh pr diff, git fetch, git log, and gh pr edit to gather data and apply changes.

tailrocks-refresh-pr