The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file employs the exclamation preprocessor (!) to execute a bash script (preflight.sh) at the moment the skill is loaded. The use of ${ARGUMENTS} within this shell command (!bash ${CLAUDE_SKILL_DIR}/scripts/preflight.sh ${ARGUMENTS}``) is unsafe, as it allows for arbitrary command injection if the user or agent provides input containing shell metacharacters.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted data sourced from GitHub pull requests, such as titles, descriptions, and commit history.
Ingestion points: The scripts/preflight.sh and scripts/squash-message.sh scripts ingest PR content using the GitHub CLI (gh pr view).
Boundary markers: The workflow includes instructions for manual review of the squash message and requires operator confirmation, which serve as human-in-the-loop safeguards.
Capability inventory: The skill has the authority to perform pull request merges (gh pr merge), delete remote branches (git push origin --delete), and modify local branches (git branch -D).
Sanitization: The skill does not perform structural sanitization or escaping of the external data, relying instead on the agent's reasoning during the message drafting process to identify and ignore potential instructions embedded in the data.
[COMMAND_EXECUTION]: The skill's functionality is heavily dependent on multiple shell scripts that execute CLI commands based on pull request metadata. The lack of rigorous validation on variables derived from external data or load-time arguments increases the overall attack surface for command execution vulnerabilities.

merge-pr