The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by combining untrusted data ingestion with exploitable shell capabilities.
Ingestion points: Untrusted content enters the agent context through GitHub PR diffs and file contents (fetched via gh CLI) as well as local project files scanned during initialization (referenced in references/pr-review.md and references/auto-init.md).
Boundary markers: Absent. The instructions do not provide delimiters or specific warnings to ignore instructions that might be hidden within the code or comments of the PR being analyzed.
Capability inventory: The skill instructs the agent to perform multiple subprocess calls including gh pr diff, gh api, find, and grep to analyze codebases and PRs (referenced in references/pr-review.md and references/auto-init.md).
Sanitization: Absent. External content from GitHub and local files is processed directly for review without filtering for injection patterns.
[COMMAND_EXECUTION]: The skill relies on shell commands (gh, find, grep, xargs) to automate project detection and code review. These operations are intended for the skill's primary purpose but operate on data derived from external PR URLs and file contents, which presents a surface for potential misuse (referenced in references/pr-review.md and references/auto-init.md).

compose-expert