The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on several local shell scripts (preflight.sh, squash-merge.sh, etc.) that execute git and gh (GitHub CLI) commands to interact with the repository and GitHub API. These scripts also invoke python3 for JSON processing and mise for running local linting tasks.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it ingests untrusted data from GitHub pull requests, including descriptions and commit messages.
Ingestion points: scripts/preflight.sh and scripts/squash-message.sh use gh pr view to fetch the PR body and commit history.
Boundary markers: The instructions provide guidelines to the agent on how to interpret these fields (e.g., distinguishing Markdown for reviewers from plain text for the git log), but no formal delimiters are used when interpolating this data into the agent's context.
Capability inventory: The skill possesses high-privilege capabilities including merging pull requests (gh pr merge) and deleting local/remote branches (git branch -D, git push origin --delete).
Sanitization: The scripts use jq and python3 to parse JSON metadata from GitHub, providing some protection against malformed data, but they do not sanitize the natural language content for potential instructions.
[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file uses the platform-specific !command`` syntax to execute scripts/preflight.sh. This is used legitimately to provide the agent with immediate context regarding the target pull request's status.

codex-merge-pr