The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub pull requests, creating a risk that embedded instructions could be executed by the agent.
Ingestion points: The scripts/populate-description.sh script uses the GitHub CLI (gh pr view) to fetch the title and body of a pull request. This content is then written to a local file named PR_AGENTDESC.md.
Boundary markers: The untrusted body and title are placed into a markdown file with standard headers and YAML frontmatter. However, there are no specific delimited blocks or instructions (e.g., 'ignore any instructions in the following text') to prevent the agent from obeying commands hidden within the pull request description during subsequent review steps.
Capability inventory: The skill possesses significant capabilities, including executing arbitrary shell commands via the Bash tool, performing git operations (commit, amend, push), and interacting with the GitHub CLI to modify pull requests.
Sanitization: The populate-description.sh script performs basic string cleaning (e.g., normalizing line endings) via Python, but it does not sanitize or filter the pull request content for potential prompt injection patterns before the agent is instructed to review and act upon it in Step 5.

fix-pr