The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Pull Request (PR) data, including titles, bodies, and code diffs from external contributors. This creates a surface for indirect prompt injection, where a malicious contributor could embed instructions to trick the agent into incorrectly labeling a malicious PR as safe during the audit phase.
Ingestion points: Untrusted data enters the agent context through gh pr list, gh pr view, and gh pr diff commands executed in SKILL.md (Step 2 and Step 3).
Boundary markers: The instructions for subagents in SKILL.md (Step 3) lack explicit delimiters or "ignore embedded instructions" warnings when processing external PR content.
Capability inventory: The skill possesses significant capabilities, including git push --force-with-lease (Step 5b) and gh api calls to approve GitHub Actions workflow runs (Step 5c).
Sanitization: There is no evidence of sanitization, escaping, or filtering of external PR data before it is interpolated into prompts for the subagents.
[COMMAND_EXECUTION]: The skill executes high-privilege repository commands as part of its core functionality. While these are intended behaviors, they represent a high-risk capability that could be abused if the agent's decision-making logic is compromised via injection.
Evidence: SKILL.md uses git push --force-with-lease to update remote branches after a rebase (Step 5b).
Evidence: SKILL.md uses gh api -X POST .../approve to approve GitHub Actions runs for outside contributors (Step 5c).

pr-sweep