The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions direct the agent to construct and execute shell commands such as git rev-parse --verify --quiet <arg>, gh pr view <n>, and gh pr diff <n> using variables derived from user input. This pattern presents a command injection risk if the underlying agent platform does not sanitize the arguments before passing them to the shell.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from arbitrary external URLs (tickets, documentation) or pasted text. This content is processed by both the main agent and subagents, which could allow malicious instructions embedded in the external sources to influence the agent's behavior.
Ingestion points: Untrusted content enters the context via $ARGUMENTS, which can be a URL or a pasted document body.
Boundary markers: The instructions do not specify the use of delimiters or warnings to ignore embedded instructions when processing external data.
Capability inventory: The skill uses file system tools (git, mktemp), GitHub CLI integration, network fetching capabilities, and subagent invocation.
Sanitization: No explicit sanitization or filtering of the fetched content is required before analysis, although the agent is instructed to extract PR numbers from URLs.
[EXTERNAL_DOWNLOADS]: The skill initiates network requests to fetch the content of URLs provided in the arguments. Processing arbitrary remote content introduces risks associated with untrusted data and potential tracking or exploitation if the agent executes scripts found within.

understand