The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes Pull Request diffs, titles, and bodies which are untrusted external inputs. These inputs are analyzed by an agent with shell access and API capabilities. There are no explicit boundary markers or directives provided to separate PR content from review instructions, creating a surface for indirect prompt injection.
Ingestion points: gh pr view, gh pr diff, and git diff commands in SKILL.md.
Boundary markers: Absent in the domain reference files.
Capability inventory: Shell execution (gh, git, find) and Node.js execSync in post-review.js.
Sanitization: Not specified in the instructions for processing PR data.
[COMMAND_EXECUTION]: The skill instructions and the associated post-review.js script construct shell commands using string interpolation of variables derived from the PR or environment. Specifically, the devops.md guideline suggests using find . -name "<filename>" where <filename> is an untrusted name from the PR, which could lead to command injection if malicious filenames are present.
[DYNAMIC_EXECUTION]: The skill attempts to dynamically load and read instructions from other skills (e.g., test-validity-review and testing-best-practice) based on local file paths. This introduces a dependency on the integrity of the local environment's skill configuration.

cc-pr-review-ci