The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (git commit messages and code diffs) which may contain instructions designed to influence the agent's behavior during its analysis phase.
Ingestion points: Commit messages are read using git log and the code diff is read using git diff in SKILL.md (Step 2).
Boundary markers: Absent. The instructions tell the agent to "read and internalize it silently" but do not provide specific delimiters or instructions to ignore embedded commands within the diff or logs.
Capability inventory: The skill uses bash to interact with the repository and has access to standard Read, Write, and Edit tools.
Sanitization: Absent. Data from the pull request is processed as raw text without evidence of filtering or escaping.
[COMMAND_EXECUTION]: The workflow relies on shell command templates that incorporate user-provided input, which could lead to command injection if the input is not validated.
Evidence: In SKILL.md, user input for <PR_NUMBER> is directly interpolated into commands like git fetch origin pull/<PR_NUMBER>/head:pr-<PR_NUMBER> and git branch -D pr-<PR_NUMBER>. A malicious user could potentially inject additional shell commands if the agent platform does not strictly validate that the input is a numeric PR ID.

pr-grill-me