The Agent Skills Directory

[SAFE]: The skill implements several security best practices. It explicitly restricts file modifications to the .github/ directory and prohibits mutating API calls, force-pushing, or deleting repositories without explicit user approval. All pull requests are created as drafts, ensuring a mandatory review phase before any changes are merged into the codebase.- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute git and gh (GitHub CLI) commands. These operations are strictly scoped in the allowed-tools metadata to specific subcommands (e.g., git checkout, git add, gh pr create), which effectively prevents arbitrary shell command injection.- [INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted data by reading GitHub workflow files. While this creates a potential surface for indirect prompt injection, the risk is mitigated by the skill's operational rules.
Ingestion points: Workflow files (YAML) are read from the .github/ directory to identify action usage.
Boundary markers: No specific delimiters are used when the agent processes the file content.
Capability inventory: The skill has the capability to write files (Edit) and perform network-related operations (gh pr create).
Sanitization: Content from the files is used to populate PR titles and summaries without explicit sanitization.
Mitigation: The requirement for the agent to display a git diff and obtain user confirmation before every commit provides a critical manual checkpoint to detect unintended or malicious modifications.

action-remediate