The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository (commit messages, diffs, and PR templates) to generate Pull Request content. This creates a surface where malicious instructions hidden in the code or history could influence the agent's output.
Ingestion points: Workflow Step 6 (logs, diffs) and Step 7 (PR templates) in SKILL.md.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are provided when interpolating this data into the PR body.
Capability inventory: The agent uses git and gh CLI for file staging, commits, pushing, and remote API calls.
Sanitization: No sanitization or validation of the ingested repository content is performed before generating the PR title and description.
[COMMAND_EXECUTION]: The skill uses automated shell commands to manage the git lifecycle. Specifically, Step 3 uses git add -A to stage all changes in the working tree automatically. While this facilitates the workflow, it could lead to the accidental staging and committing of sensitive local files or secrets if they are not explicitly listed in .gitignore.
[DATA_EXFILTRATION]: Repository contents, including source code diffs and commit history, are read from the local environment and transmitted to GitHub via the gh CLI. This is the intended primary purpose of the skill, facilitating the flow of project data to a well-known external service.

create-pr