The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses standard system utilities including gh, git, jq, grep, and find to perform its tasks. It demonstrates safe scripting practices by sanitizing repository names for use in filesystem paths (via tr) and consistently using double quotes around shell variables (e.g., "$WORKDIR", "$PR") to prevent word splitting and command injection.
[DATA_EXPOSURE]: The skill accesses local repository content, including the .github/instructions/ directory and up to 5 additional files outside the PR diff for context. This data access is controlled and scoped to the repository being reviewed.
[DATA_EXFILTRATION]: The skill communicates with GitHub's official API and CLI to fetch PR data and post review comments. These network operations are directed at a well-known service (GitHub) and are essential for the skill's primary function.
[PROMPT_INJECTION]: The skill is subject to indirect prompt injection because it ingests untrusted content from Pull Request titles, bodies, and comments. This is an inherent attack surface for any automated code review tool. The skill mitigates risks by using structured JSON for inline comments and quoted here-docs for summary comments, which prevents the content from being interpreted as shell commands by the executing agent.
[CLEAN_UP]: The skill includes a mandatory cleanup step that securely clears the contents of temporary files created during execution, preventing sensitive data or large diffs from persisting in shared /tmp space across multiple runs.

review-pr