The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a high-autonomy workflow ("full send") where the agent processes repository data that may include content from untrusted contributors. Maliciously crafted comments or PR metadata could potentially influence the agent's logic during its autonomous execution phase.
Ingestion points: The skill and its sub-agents (e.g., 'Comment Sicko') ingest data from source file comments, git history (git log, git blame), and GitHub pull request metadata (gh pr view).
Boundary markers: The instructions do not define clear delimiters or "ignore" warnings when the agent reads external code or PR strings before processing them.
Capability inventory: The skill is explicitly granted permission to merge pull requests, force-push branches, and execute diverse testing methods (including browser automation and dev servers).
Sanitization: There is no explicit sanitization or filtering logic applied to the strings fetched from the repository or GitHub API.
[COMMAND_EXECUTION]: The skill utilizes standard development tools, including git for branch management and gh (GitHub CLI) for pull request operations. It also assumes the ability to run arbitrary test suites and development servers as part of its verification process. While these are necessary for the skill's function, they represent a significant capability set if directed by malicious input.

full-send