The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow explicitly directs the agent to "run pr-body.md", which is a temporary file containing the PR description. Because this description is dynamically generated from repository diffs, an attacker could inject shell commands into code comments that would then be executed by the agent when it attempts to "run" the file.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to "install dependencies" if repository checks fail. This allows a potentially malicious repository to trigger the installation of arbitrary packages from external registries, presenting a significant supply chain risk.
[COMMAND_EXECUTION]: The use of GH_PROMPT_DISABLED=1 and GIT_TERMINAL_PROMPT=0 suppresses all interactive confirmation and security prompts. This removes critical human-in-the-loop safeguards, allowing the agent to perform automated actions, such as pushing code or creating PRs, without verification.
[DATA_EXFILTRATION]: The instruction to use git add -A followed by a push to a remote origin automatically stages and exfiltrates all local changes. This includes the risk of unintentionally uploading sensitive information like environment variables, local secrets, or configuration files that have not been reviewed.

yeet