The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted text from pull request conversations and logs, presenting an indirect prompt injection surface.
Ingestion points: Code review comments, issue comments, and check descriptions are pulled via GitHub CLI API calls in scripts/fetch_pr_feedback.py and scripts/fetch_pr_checks.py.
Boundary markers: No specific boundary markers or defensive instruction safeguards are established around the fetched content when it is evaluated by the agent.
Capability inventory: The skill workflow grants the agent authorization to modify code locally, run tests using uv, and push changes using git commit and git push.
Sanitization: Text strings are truncated for display summaries, but the full content is processed without filtering or safety sanitization against potentially adversarial text instruction blocks within comments.
[COMMAND_EXECUTION]: Multiple bundled scripts call subprocess.run() to interface with the local gh executable. These calls are executed safely with arguments passed as lists rather than raw strings (shell=False), and inline arguments are serialized using json.dumps(), which successfully prevents command injection vulnerabilities.

iterate-pr