The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/check-stack-status.ts and the examples in references/automation-patterns.md use execSync to execute shell commands with unsanitized string interpolation for the --repo argument. This allows for potential command injection if a malicious repository name is provided to the script or used in the automation logic.
[PROMPT_INJECTION]: The skill documentation encourages the creation of an autonomous agent that reads and acts upon external pull request comments, which is a surface for Indirect Prompt Injection (Category 8).
Ingestion points: Pull request comment bodies are fetched from the GitHub API in references/automation-patterns.md (e.g., in the getOpenComments and autoFixCallback functions).
Boundary markers: None identified. The instructions do not define clear boundaries between system instructions and the content of external comments.
Capability inventory: The documented patterns include high-impact capabilities such as command execution (execSync), repository modification (git push), and automated thread interaction via the GitHub CLI.
Sanitization: No evidence of input sanitization or validation of the comment content before processing it to determine agent actions or applying code fixes.

stacked-prs