The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the !command syntax to execute scripts/context.sh at load time to gather repository state.
Evidence: !bash ${CLAUDE_SKILL_DIR}/scripts/context.sh`` in SKILL.md.
Context: The script gathers branch names, commit logs, diffs, and GitHub issues to provide immediate context for the agent, which is a legitimate performance optimization for pull request automation.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from git logs and external issue titles, creating a surface for potential injection.
Ingestion points: The scripts/context.sh script retrieves data from git log, git diff, and gh issue list.
Boundary markers: While the skill enforces a specific output format for PR_AGENTDESC.md, it lacks explicit delimiters or instructions to ignore potential commands embedded within the diffs or commit messages.
Capability inventory: The agent is capable of writing to the file system and executing local scripts.
Sanitization: No sanitization is applied to the data retrieved from the repository history or issue tracker.
[REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute a shell script that is not provided in the analysis bundle, making it an unverifiable dependency.
Evidence: bash .claude/skills/pr/scripts/validate-description.sh in SKILL.md.
Concern: The agent is directed to run an external script whose contents cannot be verified, representing a potential risk if the repository contains malicious scripts at that location.

write-pr-description