The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including commit messages, full file diffs, and GitHub issue descriptions, to analyze changes and draft PR titles and bodies. This creates a surface where malicious instructions embedded in the analyzed data could potentially influence the agent's behavior or output.
Ingestion points: The skill reads commit messages and diffs via git and issue content via gh in Step 1.
Capability inventory: The skill has the ability to execute shell commands (gh pr create, gh pr edit) and write files to the local filesystem (apply_patch).
Boundary markers: No explicit boundary markers or instructions to ignore embedded instructions are used when processing the external data.
Sanitization: There is no mention of sanitizing or escaping the content retrieved from git or GitHub issues before it is used to draft the PR.
[COMMAND_EXECUTION]: The skill uses shell commands to interact with GitHub and the local system. It interpolates AI-generated content (the PR title) directly into a shell command line (gh pr create --title "<TITLE>" ...), which could be a concern if the execution environment does not properly escape shell-sensitive characters.
Evidence: gh pr create --title "<TITLE>" --body-file .turbo/pr/<tag>-body.md in Step 4.
Evidence: gh pr view <PR_URL> --json body --jq .body in Step 4.

create-pr