The Agent Skills Directory

Command Execution with User-Supplied Arguments: The skill instructs the agent to execute shell commands using gh (GitHub CLI) or curl. These commands are constructed by interpolating the user-provided $ARGUMENTS (PR number or URL). This pattern presents a security consideration where a malicious user could attempt command injection by providing a crafted PR number containing shell metacharacters (e.g., ;, &, |). While the allowed-tools field restricts execution to gh pr comment, careful validation of the input by the agent is necessary to maintain security.
Access to Sensitive Environment Tokens: The skill explicitly references the use of $GITHUB_TOKEN for authentication when using the GitHub REST API. Accessing and utilizing authentication tokens is a standard requirement for this functionality, but it represents the handling of sensitive credentials. It is a best practice to ensure the token provided to the agent's environment is scoped with the minimum permissions necessary for the task.
Indirect Prompt Injection Surface: The skill ingests data from the user to identify which PR to act upon. Because this external data is used to perform actions like posting comments and executing commands, it serves as an ingestion point for potential indirect prompt injection. The skill lacks explicit boundary markers or sanitization instructions for this input, relying on the platform's tool-calling protections and the agent's own filtering.
Manifest and Instruction Mismatch: The allowed-tools configuration only permits gh pr comment, yet the instructions provide a fallback method using curl. This inconsistency means the skill might fail to perform its fallback logic if the execution environment strictly enforces the tool whitelist, though this restriction acts as a safety boundary by preventing unauthorized network tools from being used.

trigger-pipelines-for-copilot-pr