The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes explicit instructions to bypass platform-level security guardrails. Specifically, it directs the agent to set dangerouslyDisableSandbox: true when a safety classifier blocks authorized git push --force-with-lease operations. This represents a deliberate attempt to override environmental security controls.
[METADATA_POISONING]: The skill's YAML frontmatter contains deceptive metadata. It references a non-existent OpenAI model version (gpt-5.6-terra), which could mislead users or automated systems regarding its capabilities and requirements.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external PR comments, which are untrusted inputs.
Ingestion points: The skill fetches unresolved comments from GitHub (inline, review bodies, and conversation comments) across multiple surfaces in Step 3.
Boundary markers: There are no formal boundary markers or "ignore embedded instructions" warnings implemented to prevent the agent from obeying malicious instructions hidden within PR comments.
Capability inventory: The skill has extensive capabilities, including direct file modification (Edit, Write), network communication via the GitHub API (gh api), and execution of system commands and build tools (git, npm, cargo, make).
Sanitization: The skill lacks explicit sanitization or validation logic for the content of processed comments before they are used to generate code suggestions or influence triage decisions.
[COMMAND_EXECUTION]: The skill utilizes a broad suite of shell-based development tools and package managers (git, gh, npm, cargo, make, bundle, ruby) to perform repository maintenance, code verification, and deployment tasks.

wk-pr-resolve