The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from PR/MR thread comments and SAST tool annotations to automate code fixes and terminal command execution.
Ingestion points: scripts/pr-state.ts (fetches thread comments) and scripts/extract-findings.ts (extracts review comments and vulnerability findings).
Capability inventory: The skill utilizes write, edit, and exec tools to modify project files and run build/test commands based on the external input.
Boundary markers: No explicit delimiters or instructions are used to separate untrusted external content from the agent's internal reasoning, creating a surface for potential instruction override.
Sanitization: Input content is used directly for analysis with minimal sanitization beyond length truncation for summaries.
[COMMAND_EXECUTION]: The skill's primary workflow relies on executing shell commands through bun, node, gh, and glab to perform repository management and API interactions with GitHub and GitLab.
[PRIVILEGE_ESCALATION]: The skill provides scripts (scripts/runner.cjs) to register and start a self-hosted GitHub Actions runner. This operation allows the execution of arbitrary code defined in repository workflows on the host machine. The skill's documentation identifies this as a security-sensitive operation and requires explicit user approval through the message_user tool.
[EXTERNAL_DOWNLOADS]: The scripts/runner.cjs script downloads the official GitHub Actions runner binary from GitHub's repository. This download targets a well-known and trusted source for development infrastructure.

act