The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to learn a user's review style by analyzing raw pull request data, including descriptions and comments. This data is untrusted and can be controlled by external actors. A malicious user could submit a PR with hidden instructions designed to bias the model, skip specific security checks, or influence the AI's review posture during future evaluations.
Ingestion points: scripts/collect-pr-evidence.py and scripts/collect-review-activity.py fetch the body field of PRs and comments directly from the GitHub API.
Boundary markers: The instructions lack specific delimiters or directives to the agent to ignore any potential instructions embedded within the fetched GitHub content.
Capability inventory: The resulting 'Clone' skill has the capability to write to the local filesystem and execute GitHub CLI commands to post reviews and comments.
Sanitization: No sanitization or filtering of the fetched text is performed before the agent interprets it to build the user model.
[DYNAMIC_EXECUTION]: The skill's primary function is to dynamically generate a new agent skill (SKILL.md) and associated data files (VOICE.md, MEMORY.md) at runtime in a local directory (~/.agents/skills/). This generated skill is persistent and will be loaded and executed in future sessions.
[PERSISTENCE_MECHANISMS]: By creating a new skill in a known agent directory, the skill establishes a way for its generated instructions to persist across sessions. While this is the intended purpose, it represents a standard persistence vector for AI agent environments.
[COMMAND_EXECUTION]: The skill invokes bundled Python scripts that interact with the GitHub CLI (gh). These scripts use subprocess.run() to execute commands based on parameters supplied by the main agent. While these scripts are part of the skill, the instructions specifically discourage the agent from auditing the script source code before the first execution.

reviewer-clone