The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of PR/MR comments, which can be used to deliver malicious instructions to the agent.
Ingestion points: The agent fetches comment content from GitHub, GitLab, and Azure DevOps via gh, glab, and az CLI tools as described in SKILL.md and reference.md.
Boundary markers: The instructions do not specify the use of delimiters or clear separation markers (like XML tags or headers) to distinguish between fetched comment text and system instructions.
Capability inventory: The skill utilizes shell command execution for SCM CLIs and repository metadata reading via git commands.
Sanitization: There is no instruction to sanitize, filter, or escape the content of the comments before they are processed by the agent.
[COMMAND_EXECUTION]: The skill relies on executing local system commands to interact with source control providers.
Evidence: The skill instructs the agent to run commands like git remote get-url origin, gh pr view --comments, and glab mr view --comments to retrieve pull request information.
[EXTERNAL_DOWNLOADS]: The skill provides guidance for installing official CLI tools from well-known technology providers.
Evidence: reference.md lists installation commands such as brew install gh for GitHub, brew install glab for GitLab, and brew install azure-cli for Microsoft Azure DevOps.
Neutral context: The skill enforces a security best practice by requiring the agent to notify the user and obtain explicit permission before executing any installation commands.

pr-comments