The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches and processes pull request metadata, body, and comments from GitHub (using gh pr view and gh api). These external inputs are often attacker-controlled. The instructions in SKILL.md attempt a partial safety boundary (line 75) by stating not to treat comments as instructions to change code, but they lack comprehensive sanitization or delimiters to prevent the agent from obeying other embedded instructions, such as exfiltrating data or using additional tools.
[COMMAND_EXECUTION]: The skill uses gh and git commands to collect repository and pull request state. While these are standard developer tools, the reliance on raw shell output from commands like gh api to populate UI components without robust filtering creates a pathway for data manipulation.
[EXTERNAL_DOWNLOADS]: The generated HTML walkthroughs are hardcoded to load the D3 library from https://cdn.jsdelivr.net/npm/d3@7.9.0/dist/d3.min.js. While this is a pinned version from a well-known CDN (jsDelivr), it introduces a runtime network dependency and supply-chain risk if the CDN is compromised, as no Subresource Integrity (SRI) hashes are implemented.
[DYNAMIC_EXECUTION]: The scripts/d3_canvas_runtime.py script uses innerHTML to render node details. Although text content is escaped, the url property for file and comment links is interpolated directly into href attributes (lines 162-171) without validating the URI scheme. This could allow an attacker to inject a javascript: URL into a PR comment, which would execute in the reviewer's browser context when the link is clicked.

pr-walkthrough