The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could potentially contain malicious instructions designed to influence the agent.
Ingestion points: The agent is directed in SKILL.md to "Read repository PR/release instructions and template" and "read the live PR" to verify state.
Boundary markers: There are no specific delimiters or instructions to treat these external inputs as untrusted data separate from the agent's operational logic.
Capability inventory: The skill has the ability to push code to remote repositories, create or update pull requests, and establish automated monitors that can autonomously push fixes to the head branch.
Sanitization: There is no mention of sanitizing or validating the content retrieved from PR templates or live PR data before the agent acts upon it.
[DYNAMIC_EXECUTION]: The skill instructs the agent to create an automated "monitor" with a dynamically generated prompt.
Evidence: The SKILL.md file defines a detailed instruction set for a "saved prompt" that governs the behavior of a recurring automated task. This task is granted the authority to perform git operations, validate code, and reassess security risks without direct human intervention for each step.

create-pr