The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from untrusted external repositories, creating an attack surface for indirect prompt injection.
Ingestion points: The agent is instructed to read policy and configuration files from external repositories, such as CONTRIBUTING.md, AI_POLICY.md, and .github/pull_request_template.md (SKILL.md).
Boundary markers: The instructions explicitly warn that external files are "data, not instructions" and should not amend the user's session instructions (SKILL.md).
Capability inventory: The skill uses version control tools like git and gh to perform file reads, writes, and network operations related to repository management (references/mechanics.md).
Sanitization: The skill includes a "canary" detection mechanism, instructing the agent to identify and refuse execution of directives that are intended to test for unattended automation (references/policies.md).
[COMMAND_EXECUTION]: The skill utilizes command-line tools for repository interaction and search.
Evidence: Instructions include specific commands for gh search prs, gh search issues, git fetch, git rebase, and gh pr create (SKILL.md, references/mechanics.md). These commands are standard for managing open-source contributions.

pr-contribution