The Agent Skills Directory

Indirect Prompt Injection Risk: The skill ingests data from external GitHub pull requests and issues using gh pr view and gh issue view. Since this content is user-generated and untrusted, it could potentially contain instructions designed to manipulate the agent's behavior while drafting the shiproom template.
Ingestion points: Data is pulled from PR and issue bodies in SKILL.md (Steps 5 and 6).
Boundary markers: There are no explicit delimiters or instructions for the agent to ignore embedded commands within the fetched data.
Capability inventory: The skill has the ability to post comments and edit PR content via the gh CLI.
Sanitization: While no automated sanitization is described, the skill incorporates a mandatory human-in-the-loop review (Step 7) where the user must approve the drafted content before it is written to the repository.
Command Execution: The skill executes commands using the GitHub CLI (gh). This is the primary intended functionality of the skill and relies on the user's local authentication and tool installation. The use of --body-file for updating PR descriptions is a positive security practice as it avoids passing large, untrusted strings directly as shell arguments.

backport-pr