The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill processes data from an external, potentially attacker-controlled source (GitHub PR comments). While it implements a strong mitigation strategy, the surface remains a risk factor for trusted accounts or sophisticated injection patterns.
Ingestion points: Pull request comments, review bodies, and inline thread content are fetched via the GitHub API (gh api) in Phase 2.
Boundary markers: Comments are converted into synthetic finding blocks and passed to sub-agents. The instructions do not specify the use of strict delimiters or escaping for the raw comment text before it is processed by the LLM.
Capability inventory: The skill has access to shell tools (git, gh), file system modification tools (Read, Edit, Write), and the ability to dispatch sub-tasks via Task to apply code changes.
Sanitization: The skill employs a comprehensive trust-policy.md which mandates verifying the author of every comment. Only verified organization members, authorized collaborators, or whitelisted bots are treated as actionable sources. This reduces the exposure to external prompt injection attempts.
[COMMAND_EXECUTION]: The skill makes extensive use of the gh (GitHub CLI) and git tools to manage repository state, fetch API data, and push code changes. These operations are core to the skill's stated purpose of PR management.

drive-pr