The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted content from GitHub Pull Requests and GitLab Merge Requests, which can contain malicious instructions intended to mislead the reviewing models.
Ingestion points: PR title, body, commits, and linked issue content are fetched in scripts/lib/forge.mjs and scripts/review-pr.mjs.
Boundary markers: Ingested data is interpolated into prompt templates without using specific delimiters or safety instructions to separate untrusted data from agent instructions.
Capability inventory: The orchestrator can post comments and findings back to the PR/MR via the gh or glab tools.
Sanitization: The skill validates the structure of the LLM responses against a JSON schema but does not sanitize the input PR content.
[COMMAND_EXECUTION]: Shell commands for git, gh, and glab are executed using spawnSync in scripts/lib/shell.mjs. These are used for project-related tasks like cloning, viewing PRs, and posting comments. The implementation uses argument arrays to prevent shell injection.
[DYNAMIC_EXECUTION]: Local scripts for model interaction (delegates) are located and executed at runtime based on the skill's configuration and CLI flags in scripts/lib/dispatch.mjs. This involves constructing paths and spawning new node processes.
[EXTERNAL_DOWNLOADS]: Fetches source code by cloning repositories from GitHub and GitLab to a local cache folder (~/.cache/debate-review/clones). These operations utilize official domains of well-known version control services.

debate-review