The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the git repository's commit history and passes it to another language model process to generate PR content. An attacker who can contribute commits to the repository could potentially influence the generated PR title or body through malicious instructions embedded in commit messages.
Ingestion points: Commit logs gathered via git log --format='%n%s' --name-only and git log --format=%b (SKILL.md).
Boundary markers: The skill attempts to mitigate injection by wrapping the log content in <material> tags when passing it to the write-like-me skill.
Capability inventory: The skill possesses the ability to perform git push, gh pr create, gh pr edit, and gh pr merge (SKILL.md).
Sanitization: The skill relies on formatting instructions to the write-like-me sub-skill and basic log filtering (removing reverts and bumps) but does not perform robust sanitization of commit subjects or bodies.
[COMMAND_EXECUTION]: The skill performs sensitive repository operations using the GitHub CLI (gh) and git.
Evidence: The skill executes git push, gh pr create, gh pr edit, and gh pr merge to modify the state of remote and local branches.
Context: While these are the primary functions of the skill, they represent a significant capability tier that could be abused if the agent is misled by injected instructions.
[PROMPT_INJECTION]: The instructions include steering commands that reduce user oversight by discouraging the agent from seeking confirmation.
Evidence: "Invoking this skill IS the request. Your task is fully specified here. Never ask what to do." (SKILL.md).
Context: This instruction is intended to facilitate automation but reduces the human-in-the-loop safety margin for sensitive operations like pushing and merging code.

pr