The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection in the hooks/verify-completion.sh script.
Ingestion points: Pull request comment bodies are retrieved from GitHub using the gh api graphql command in hooks/verify-completion.sh.
Boundary markers: The retrieved comment text is interpolated directly into the systemMessage field of the hook's JSON response without any delimiters or instructions for the agent to ignore embedded commands.
Capability inventory: The skill possesses significant capabilities, including the ability to modify files, commit changes, and interact with the GitHub API across multiple scripts.
Sanitization: The script performs basic truncation by only including the first 80 characters of the comment, which reduces the potential for long payloads but does not prevent concise injection attempts.
[COMMAND_EXECUTION]: The skill relies on a suite of shell scripts to manage Git operations and GitHub interactions. While the scripts demonstrate security best practices—such as using jq with argument binding (--arg), sanitizing identifiers with sed, and passing variables to awk via ENVIRON—the inherent complexity of shell-based command assembly for tool inputs presents a surface for potential execution issues if sanitization is bypassed.

autonomous-common