The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it analyzes and incorporates potentially untrusted data from the repository's history and current changes. * Ingestion points: The skill reads content from git log, git diff, and .github/PULL_REQUEST_TEMPLATE.md as specified in the Workflow sections of SKILL.md. * Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard embedded instructions within the git output. * Capability inventory: The skill possesses the capability to execute shell commands via the Bash tool, including gh pr create. * Sanitization: The skill does not implement sanitization or validation of the text extracted from the git logs and diffs before using it to construct the pull request.
[COMMAND_EXECUTION]: The skill performs its primary workflow by executing various system commands. * Evidence: The workflow in SKILL.md relies on git for repository state and gh for authenticated interactions with GitHub, which are well-known and expected tools for this use case.

create-pr