The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and act upon data from external, potentially attacker-controlled sources such as GitHub pull request descriptions and branch names.
Ingestion points: The agent is directed to use gh pr view to read PR descriptions for cross-links and to use git branch -a --contains HEAD to identify related branches. These fields can be populated with malicious instructions by third parties.
Boundary markers: Absent. There are no instructions for the agent to use delimiters or ignore instructions embedded within the PR metadata.
Capability inventory: The skill utilizes powerful tools including git (push, checkout, fetch), gh CLI (PR viewing and merging), pnpm (installing and building), and python/uv (script execution and package installation).
Sanitization: The skill does not define any sanitization or validation steps for the content retrieved from GitHub PRs.
[COMMAND_EXECUTION]: The skill performs various shell-based operations essential for software development. This includes running a Python schema regeneration script (python src/inspect_ai/_view/schema.py), building TypeScript packages with pnpm, and managing environments with uv pip install. These operations are consistent with the skill's stated purpose but represent a significant execution surface.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch data from GitHub (git fetch, git clone) and install dependencies via pnpm and uv. These operations target well-known services and repositories, which is considered standard behavior for development-oriented skills.

land-ts-mono