The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill relies on a {description} variable, likely sourced from user input or context, to generate branch names, commit messages, and PR titles. This input lacks boundary markers or sanitization, potentially allowing malicious instructions in the description to influence agent behavior in later steps of the workflow.
Ingestion points: The {description} variable used throughout SKILL.md for Git and GitHub CLI commands.
Boundary markers: None present in the instructions to delimit user-provided data.
Capability inventory: The skill has access to the Bash tool, allowing it to execute arbitrary commands, and uses the gh and git binaries.
Sanitization: No sanitization or validation of the {description} content is performed before interpolation into shell commands.
[COMMAND_EXECUTION]: The workflow explicitly instructs the agent to "install dependencies and rerun once" if checks fail. This gives the agent autonomy to execute installation commands based on tool output or error messages, which could be exploited by a malicious repository providing deceptive error messages to trigger the installation of malicious packages.
[DYNAMIC_EXECUTION]: The skill contains an instruction to "Write the PR description to a temp file... and run pr-body.md". While likely intended to refer to using the file as input for the gh pr create command, the literal instruction to "run" a file containing user-influenced content (the PR description) creates a risk of the agent attempting to execute a markdown file as a script if it interprets the command literally.

openai-yeet