The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from external sources that could be leveraged to influence the agent's behavior.
Ingestion points: The scripts/diagnose.sh script fetches GitHub Action logs using gh run view --log-failed, and scripts/populate-description.sh retrieves pull request titles and bodies using gh pr view.
Boundary markers: Content is segmented with text-based headers (e.g., == failures ==, log:), but there are no explicit instructions or robust delimiters to prevent the agent from following instructions embedded within the ingested data.
Capability inventory: The agent can execute git commands (commit, rebase, push), perform GitHub operations, and run local test/build tasks via mise.
Sanitization: There is no active sanitization or filtering of the ingested external content for malicious instruction patterns.
[COMMAND_EXECUTION]: The skill executes shell scripts and orchestrates several development CLI tools.
The scripts/diagnose.sh script contains a hardcoded mapping between GitHub job names and local mise reproduction commands. Because the command strings are fixed in a shell case statement, job names from untrusted PRs cannot be used to inject arbitrary shell commands.
The agent relies on standard authenticated toolchains (gh and git) to implement the PR fixing workflow.

codex-fix-pr