The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external GitLab resources such as issue titles and merge request notes to automate workflows.
Ingestion points: The scripts/create-mr-from-issue.sh script fetches issue titles via the glab issue view command.
Boundary markers: The script includes explicit developer warnings regarding untrusted content and uses strict character filtering for branch names.
Capability inventory: The skill utilizes git for local repository operations and glab for API-driven actions like commenting, approving, and merging.
Sanitization: Scripts employ robust character sanitization for branch naming and include a specialized sanitize_terminal function in the Python helper to strip terminal control characters and redact potential credentials from error logs.
[COMMAND_EXECUTION]: The skill uses shell and Python scripts to automate command-line interface interactions.
scripts/mr-review-workflow.sh executes test commands; however, it implements a strict ALLOWED_COMMANDS whitelist to ensure only approved test runners (e.g., npm test, pytest) are executed.
scripts/post-inline-comment.py invokes the glab binary using list-based arguments with subprocess.run, which prevents shell injection vulnerabilities.
[DYNAMIC_EXECUTION]: The documentation and scripts utilize local script generation to facilitate complex API interactions.
SKILL.md provides examples of using Python heredocs to construct valid JSON payloads for the GitLab API.
scripts/post-inline-comment.py dynamically calculates diff anchors and line codes to post precisely targeted inline comments, which is a core function of the skill.

glab-mr