The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context injection pattern (!command) to execute preflight.sh when the skill is loaded.
Evidence: !bash ${CLAUDE_SKILL_DIR}/scripts/preflight.sh`` in SKILL.md.
The injection is used to provide the agent with situational awareness, such as the current git branch, commit history, and the status of existing pull requests.
The operations are limited to metadata gathering using trusted tools (git, gh) and do not involve executing untrusted remote code.
[INDIRECT_PROMPT_INJECTION]: The skill processes agent-generated drafts from PR_AGENTDESC.md, which represents a potential injection surface.
Ingestion points: The file PR_AGENTDESC.md is read by create-pr.sh, validate-description.sh, and preflight.sh.
Boundary markers: The workflow enforces a structured review process where a separate review-pr-description skill must provide a VERDICT: PASS signature before publication.
Capability inventory: The skill has the ability to execute git push, gh pr create, gh pr edit, and delete local draft files via rm.
Sanitization: validate-description.sh performs mechanical checks, ensuring no instructional comments, placeholders (e.g., TODO), or unclosed code fences survive into the published description.
Human oversight: Step 6 of the skill explicitly requires the operator to review the final draft and confirm the publication parameters, providing a robust defense against automated injection attacks.
[COMMAND_EXECUTION]: The skill relies on shell scripts and CLI tools to interact with the repository and GitHub API.
The skill implements protective hooks (guard-gh.sh) that intercept Bash tool calls to prevent the agent from executing direct gh pr mutations that would bypass the mandatory validation and review scripts.
All network operations are directed at GitHub, which is a well-known and trusted service provider.

pr