The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, including pull request titles and bodies (via fetchPR) and linked issue or work item content (fetchSpec in scripts/lib/forge.mjs). This content is interpolated into the main reviewer prompt (assets/prompts/review-main.md) using placeholders like {{PR_TITLE}}, {{PR_BODY}}, and {{SPEC}} without any delimiters (e.g., XML tags or triple quotes) or warnings to the model to ignore embedded instructions. This creates a surface for attackers to influence the review process through malicious text in pull request metadata.
Ingestion points: scripts/lib/forge.mjs (functions fetchPR and fetchSpec reading from GitHub, GitLab, and Azure DevOps APIs).
Boundary markers: Absent in all prompts located in assets/prompts/.
Capability inventory: Execution of git, gh, glab, and az CLI tools; writing logs and artifacts to ~/.cache/debate-review/; and dispatching sub-tasks to other agent skills.
Sanitization: Only basic HTML stripping is performed for Azure work items; no instructional escaping or sanitization is applied to the processed text for LLM ingestion.
[COMMAND_EXECUTION]: The skill relies extensively on executing external CLI tools to perform its core functions. It uses spawnSync (wrapped in scripts/lib/shell.mjs) to run git for repository management, gh for GitHub interactions, glab for GitLab, and az for Azure DevOps. These commands are constructed using parameters derived from project configurations and forge APIs.
[CREDENTIALS_UNSAFE]: For Azure DevOps authentication, the skill executes az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 to obtain a sensitive bearer token. This token is subsequently stored in the DEBATE_REVIEW_AZURE_AUTH environment variable to authenticate Git operations via environment variables.
[DYNAMIC_EXECUTION]: The dispatch function in scripts/lib/dispatch.mjs dynamically identifies and executes relay scripts from other installed skills (e.g., searching for <implementer>-delegate/scripts/relay.mjs in local agent directories). It also probes these scripts at runtime by executing them with a --help flag to verify their features and compatibility.

debate-review