The Agent Skills Directory

[COMMAND_EXECUTION]: The skill parses repository configuration files and executes the commands found within them directly on the host system.
Evidence: In references/ci-checks.md, the instructions explicitly direct the agent to "Run the script as-is" for both GitHub Actions run: steps and GitLab CI script: steps.
[REMOTE_CODE_EXECUTION]: The instruction to execute code from project-controlled files (.github/workflows/ci.yaml or .gitlab-ci.yml) creates a significant execution surface for indirect injection or supply chain attacks. An attacker who can commit to the repository can insert malicious commands into these files, which the skill will then execute when a user attempts to run CI checks locally.
Evidence: The translation logic in references/ci-checks.md maps arbitrary CI steps to local execution commands like npx or direct shell execution without any validation or sandboxing.
[PROMPT_INJECTION]: The skill processes untrusted data from the repository (commit messages, CI configs, PR templates) and incorporates it into command arguments (e.g., gh pr create) and shell execution. While the primary risk is command execution, there is a secondary risk of indirect prompt injection where malicious content in these files could influence the agent's behavior during the PR creation process.
Evidence: The skill ingests commit messages and PR templates in SKILL.md (Step 6) and uses them to generate the PR title and body for the gh or glab CLI tools.

create-pr