The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub Pull Requests, including titles, descriptions, and code diffs, which could potentially contain malicious instructions intended to influence the agent's review verdict.\n
Ingestion points: The skill fetches PR metadata, descriptions, and diffs using gh pr view and gh pr diff, and retrieves file contents via gh api in the survey branch (SKILL.md).\n
Boundary markers: While the skill uses structured outputs and severity-tagged findings, it does not explicitly define sanitization or delimiters for the untrusted PR content interpolated into findings.\n
Capability inventory: The agent has the ability to post comments, approve/block PRs, and send external notifications via the ./notify script.\n
Sanitization: Content is used to generate summaries and findings without specific escaping, although the impact is limited by a finding cap and a structured review format.\n- [COMMAND_EXECUTION]: The skill uses local CLI tools and scripts to perform its review and triage logic.\n
Evidence: It executes the gh CLI for GitHub interactions, a local scripts/skill-scan.sh to analyze skill files, and ./notify for operator alerts.\n- [EXTERNAL_DOWNLOADS]: The skill fetches repository data and file contents from GitHub.\n
Evidence: It makes authenticated calls to the GitHub API to list PRs and retrieve the contents of files for scanning. This involves a well-known service and targets repositories associated with the skill author (aeonfun).

pr-review