The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting data from the repository's git history and diffs, which are potential vectors for malicious instructions aimed at influencing the agent's output.
Ingestion points: The skill reads git log, git diff, and .github/pull_request_template.md (via SKILL.md).
Boundary markers: No specific delimiters or safety instructions are used to separate user-provided repository content from the agent's internal logic.
Capability inventory: The agent can modify external resources using gh pr create and gh pr edit.
Sanitization: The instructions do not include steps to sanitize or filter potential commands embedded in commit messages or code diffs before incorporating them into the PR description.
Autonomy risk: The instruction to "Post immediately" without waiting for user approval increases the likelihood that an injected payload could be published to a public-facing platform (GitHub) without human oversight.
[COMMAND_EXECUTION]: The skill uses git and the gh (GitHub CLI) tool to perform its primary functions, including branch analysis and pull request management. These actions are within the expected scope of a PR automation utility.

pr-description