The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub pull requests, including titles, descriptions, and code diffs, which are interpolated into prompts for analysis. Maliciously crafted PR content could attempt to influence the agent's review verdict or override its instructions.
Ingestion points: PR metadata and bodies fetched via gh pr view, code diffs from gh pr diff, and linked issue content via gh issue view.
Boundary markers: The skill instructions do not specify the use of clear delimiters or "ignore" warnings when presenting untrusted PR content to the LLM for review.
Capability inventory: The skill can post comments and reviews via gh api and gh pr review, execute local scripts (skill-scan.sh, notify), and write to the local file system.
Sanitization: While gh and jq handle data fetching, there is no evidence of sanitization of the PR content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill invokes local utility scripts including scripts/skill-scan.sh and scripts/notify.sh. While these are part of the intended functional design for security scanning and reporting, they represent powerful capabilities that interact with the host environment.

pr-review