The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the repository, such as PR templates, contribution instructions, and HTML comments, to generate pull request descriptions.
Ingestion points: Accesses files in the repository root, .github/, and docs/ directories.
Boundary markers: The instructions do not define explicit delimiters or warnings to ignore instructions that might be embedded in the template files.
Capability inventory: The skill executes gh commands and writes to temporary files on the local system.
Sanitization: While the skill correctly uses --body-file to avoid shell injection when calling the gh tool, it does not sanitize the text content extracted from templates before including it in the prompt context.

create-pr