The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external data from GitHub pull requests, which serves as a vector for indirect prompt injection.
Ingestion points: The agent ingests untrusted data from gh pr diff, PR descriptions, and PR review comments using gh pr view --comments and GitHub API calls (/pulls/<n>/comments and /pulls/<n>/reviews).
Boundary markers: The instructions do not specify the use of boundary markers or clear delimiters to isolate untrusted PR content from the agent's internal instructions.
Capability inventory: The agent possesses high-impact capabilities, including the ability to write PR comments (gh pr comment), modify the repository by committing and pushing fixes (git push), and execute arbitrary scripts defined in the repository's profile.
Sanitization: There is no evidence of sanitization or filtering of the ingested content before it is processed by the LLM.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands to manage the git environment and interact with the GitHub CLI.
Evidence: The skill uses git fetch, git worktree add, gh pr update-branch, and gh api to manage PR state and metadata.
Environment setup: The skill suggests installing tools via shell commands (e.g., apt install gh -y) if they are missing.
[REMOTE_CODE_EXECUTION]: The skill executes code provided in the pull request as part of its verification process.
Execution mechanism: By checking out the PR branch using git worktree and running the <pre_merge_entry> script (which may trigger npm test or other build tools), the agent executes code that has been modified by an external contributor. While this is the intended primary purpose of a PR review agent, it remains a mechanism for executing unverified code within the agent's environment.

pr-review