The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its reliance on untrusted external data to drive its planning logic.
Ingestion points: In Stage 1, the skill fetches PR descriptions, inline review comments, review summaries, and conversation comments via the GitHub API (gh api). It also reads linked Jira tickets.
Boundary markers: The instructions lack explicit boundary markers or delimiters to protect the model from instructions embedded within the ingested comment text.
Capability inventory: The skill has significant capabilities, including writing to the local filesystem, creating new git branches, committing code, and opening new Pull Requests on GitHub.
Sanitization: No sanitization or validation of the text content from external comments or tickets is described before the data is used to identify 'natural seams' or 'scope signals'.
[COMMAND_EXECUTION]: The skill performs automated shell operations to manage the repository state and PR lifecycle.
It uses git and the GitHub CLI (gh) to modify the environment, including converting PRs to drafts, cutting new branches, and applying diffs from the original PR.
Risk Mitigation: These operations are gated by a mandatory user approval step in Stage 6. Furthermore, the 'Auto mode' is restricted to generating a static plan file and is prohibited from performing autonomous execution, reducing the risk of unintended destructive actions.

wk-pr-break