existential-birds/beagle:plugins/beagle-core/skills/create-pr

The skill instructs the LLM to execute `gh pr create` by interpolating LLM-generated content (derived from untrusted commit messages, branch names, and diffs) directly into a shell command. This introduces two command injection vectors: 1. The `--title` argument is enclosed in double quotes (`"<title>"`), which allows shell command substitution (e.g., `$(cmd)` or `` `cmd` ``) if the generated title contains these characters. 2. The `--body` argument uses a heredoc construct (`$(cat <<'EOF' ... EOF)`). If the generated body contains the delimiter `EOF` on a new line followed by shell commands, the shell will terminate the heredoc early and execute the injected commands. An attacker who can influence commit messages or repository files can exploit this to execute arbitrary shell commands on the user's machine.