The Agent Skills Directory

[COMMAND_EXECUTION]: A potential command injection vulnerability exists in the instructions for generating the PR Playground. The branch name, retrieved from git branch --show-current, is interpolated into shell commands without proper sanitization or quoting. Specifically, the logic BRANCH_DIR = BRANCH.replace("/", "--") does not strip shell-active characters like $(), which are then passed to Bash(f"mkdir -p docs/{BRANCH_DIR}") and Bash(f"mv /tmp/*.html docs/{BRANCH_DIR}/playground.html ...").
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources to automate PR creation. An evidence chain follows:
Ingestion points: Reads git logs and diffs from the local repository (SKILL.md Phase 3) and agent activity ledgers at .claude/agents/activity/*.jsonl (SKILL.md Phase 3b).
Boundary markers: Uses Markdown headers for PR body sections but lacks explicit 'ignore embedded instructions' warnings when sub-agents process commit messages or diffs.
Capability inventory: Performs network operations via the gh CLI (creating PRs, posting comments, checking CI), performs file system writes (mkdir, mv, Write), and launches parallel sub-agents (ork:security-auditor, ork:test-generator).
Sanitization: No explicit sanitization of git log content or diffs before they are interpolated into the PR body template via HEREDOC strings.
[DYNAMIC_EXECUTION]: The skill dynamically constructs and executes tasks and sub-agents at runtime. It uses Agent(subagent_type=...) to launch security and quality auditors, and CronCreate to poll CI status with dynamically generated prompts. While these use platform-provided orchestration tools, the prompts incorporate potentially untrusted repository and branch metadata.

create-pr