The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources which could contain malicious instructions designed to manipulate the agent's behavior.
Ingestion points: The skill reads repository files, git diff outputs, and GitHub pull request diffs via gh pr diff to perform its audits (SKILL.md).
Boundary markers: The instructions do not specify the use of delimiters or clear separation between system instructions and the untrusted content being reviewed.
Capability inventory: The agent is authorized to use Edit and Bash tools, granting it the ability to modify local files or execute shell commands if successfully manipulated by injected instructions.
Sanitization: There is no evidence of content sanitization or validation of the text extracted from the files or diffs before processing.

check-claims