The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by ingesting and acting upon untrusted data from the repository environment and external interactions.
Ingestion points: Reads .github/release.yml, PR templates (e.g., .github/PULL_REQUEST_TEMPLATE.md), git log, git diff, and pull request comments via gh api.
Boundary markers: None. The skill does not use specific delimiters or instructions to ignore embedded commands within the processed data.
Capability inventory: Includes execution of git and gh CLI tools, as well as the ability to execute arbitrary bash commands identified within PR templates.
Sanitization: None. Data from templates and comments is processed without escaping or validation before being used to populate PR bodies or determine command execution.
[COMMAND_EXECUTION]: The skill performs dynamic command execution based on instructions found in external files.
Evidence: The instructions in SKILL.md (Step 3.5) direct the agent to "Analyze template for actionable instructions", "Identify bash commands in code blocks that appear to be prerequisites", and "Execute confirmed actions".
Mitigation: The skill includes a human-in-the-loop check, requiring the agent to ask "Should I execute these now?" before running identified commands, which reduces the risk of silent exploitation.

prd-done