The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (git diffs, PR bodies, and file contents) which can contain malicious instructions.
Ingestion points: SKILL.md Step 2 (git diff, gh pr view/diff, and file/directory reading).
Boundary markers: Present. Instructions are wrapped in <untrusted_diff> or <untrusted_files> tags with explicit instructions to treat them as data only.
Capability inventory: The skill uses gh CLI, git CLI, npm (to install external tools), and spawns subagents or external CLIs (Copilot/Codex) that could potentially be influenced by the data. It also includes file-editing capabilities (Edit tool) during the apply phase.
Sanitization: Argument validation is performed on PR numbers and branch names using regex. A pre-flight secret scan (references/secret-scan.md) is implemented to detect and redact credentials before sending data to external CLIs.
[DATA_EXFILTRATION]: While the skill contains a pre-flight secret scan to prevent credential leak, it explicitly notes that Copilot's CLI ignores stdin in non-interactive mode. Consequently, prompt content (including potentially unredacted secrets) is passed via the -p flag on the command line. This makes the data visible to other local users via process monitoring tools like ps or /proc/<pid>/cmdline.
[COMMAND_EXECUTION]: The skill executes shell commands (git, gh, npm) and invokes external binaries (copilot, codex). While it validates arguments, it allows the assistant to execute complex Bash blocks involving temporary file creation and environment manipulation (WORKDIR).
[EXTERNAL_DOWNLOADS]: The skill documentation suggests installing external packages (@github/copilot-cli, @openai/codex). These are well-known services, but the skill relies on the user to ensure the provenance and version pinning of these tools.

peer-review