The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data (Pull Request comments) that could contain malicious instructions designed to subvert the agent's behavior. The agent follows these instructions to modify code, push to Git, or create issues without specific sanitization of the comment body.
Ingestion points: The file CODE_REVIEW_PLAN.md uses gh api graphql to fetch Pull Request comment bodies from GitHub into the agent's context.
Boundary markers: The instructions do not use delimiters or explicit safety warnings to the agent to ignore instructions embedded in the comments it processes.
Capability inventory: The skill possesses significant capabilities including file modification, git commit, git push, and arbitrary shell command execution for project safeguards.
Sanitization: No escaping or validation is performed on the retrieved comment text before the agent uses it to decide on code changes.
[COMMAND_EXECUTION]: The instructions direct the agent to discover and run local project scripts (e.g., Makefile, test suites, linting tools). While this is intended for code verification, it allows for the execution of arbitrary commands defined within the repository's configuration files.
[DYNAMIC_EXECUTION]: The skill identifies and executes commands at runtime based on the contents of files like CLAUDE.md, AGENTS.md, or Makefile found in the target repository.
[EXTERNAL_DOWNLOADS]: The skill utilizes the GitHub CLI (gh) to fetch Pull Request data from GitHub servers. These operations are performed against a well-known service but involve the transfer of user-controlled data into the agent's execution context.

ralph-wiggum-loop