The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data that could contain malicious instructions designed to manipulate the agent's behavior.
Ingestion points: Pull request diffs (SKILL.md, Section 1.1) and issue titles/bodies (SKILL.md, Section 2.1) are passed directly into AI prompts.
Boundary markers: The prompt templates lack explicit delimiters or instructions to ignore embedded commands within the diff or issue content.
Capability inventory: The skill uses the AI's output to perform actions like github.rest.pulls.createReview, github.rest.issues.addLabels, and github.rest.issues.createComment.
Sanitization: There is no evidence of sanitization or filtering of the input data before it is interpolated into the prompt.
[COMMAND_EXECUTION]: The skill provides automation for sensitive Git operations that modify repository state.
Evidence: Section 4.1 contains a workflow that performs git rebase and git push --force-with-lease triggered by repository comments.
Evidence: Section 4.2 describes a smartCherryPick function that executes shell commands using variables derived from commit information.
[PRIVILEGE_ESCALATION]: The skill includes patterns for modifying administrative repository settings.
Evidence: Section 6.2 provides a script template to update branch protection rules (github.rest.repos.updateBranchProtection), which requires high-level administrative permissions and can alter the security posture of the repository.

github-workflow-automation