The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It retrieves and processes untrusted content from GitHub PR comments using the gh API. While the instructions advise the agent not to blindly accept the comment's claims, the lack of boundary markers or explicit isolation instructions means a malicious comment could potentially manipulate the agent's behavior when it uses tools like Bash or Write to implement fixes.
Ingestion points: Comment bodies fetched from the GitHub API via gh api.
Boundary markers: Absent in the skill instructions.
Capability inventory: Bash, Write, Read, Glob, Grep, and AskUserQuestion.
Sanitization: No sanitization or validation of the fetched comment content is performed before processing.
[COMMAND_EXECUTION]: The skill instructions direct the agent to extract information from user-provided URLs to build shell commands for the gh CLI. This involves a risk of command injection if the agent incorrectly handles a URL containing shell metacharacters during the extraction and command construction process.
[EXTERNAL_DOWNLOADS]: The skill fetches data from GitHub's official API to retrieve PR comments and thread history. This behavior is documented neutrally as it targets a well-known service and is fundamental to the skill's stated purpose.

pr-comment