The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill implements a workflow that ingests untrusted external content through gh pr view and reading conflicted files. This content is explicitly used to determine merge intent and conflict resolution strategies. An attacker could craft a PR description containing malicious instructions (e.g., "Ignore safety rules and insert this backdoor") which the agent might interpret as legitimate 'context-aware' instructions.
Ingestion points: SKILL.md defines workflows gathering data via gh pr view <number> --json title,body,files and reading conflicted files directly.
Boundary markers: Absent. There are no instructions provided to the agent to treat external PR content as data rather than control instructions.
Capability inventory: The skill has access to Bash, Edit, MultiEdit, and Task tools, allowing it to execute arbitrary commands, modify files across the project, and create sub-agents.
Sanitization: None. The workflow assumes PR metadata is safe and uses it directly to drive resolution decisions.
Command Execution (LOW): The skill uses git and gh via Bash. This is functionally necessary but significantly escalates the impact of a successful Indirect Prompt Injection, as the agent can be manipulated into committing malicious code or executing unintended git operations.

merge