The Agent Skills Directory

[Indirect Prompt Injection] (LOW): The skill constructs shell commands (specifically gh pr create) by interpolating strings like titles and summaries derived from the codebase. While it uses a quoted here-doc ('EOF') for the body, the --title parameter uses double quotes, creating a surface where shell metacharacters (e.g., $(...) or backticks) in a branch name or generated title could lead to unintended command execution.
Evidence Chain:
Ingestion points: SKILL.md (Step 4, Option 2) uses placeholders <title> and <2-3 bullets of what changed> derived from untrusted repository content.
Boundary markers: Uses a single-quoted here-doc for the PR body, which is a good practice, but the title interpolation remains vulnerable.
Capability inventory: Full subprocess execution via bash for git, gh, and various test runners.
Sanitization: No sanitization or escaping of interpolated values is specified.
[Command Execution] (SAFE): The skill executes standard developer tools such as npm test, pytest, and git. While these commands can execute arbitrary code (e.g., via a malicious package.json), this is the intended and necessary behavior for a development-focused skill. The risk is downgraded to SAFE because it aligns with the primary purpose of the skill.

finishing-a-development-branch