The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content provided by pull request authors to define the baseline for its review analysis. This content includes PR descriptions, commit messages, and specific files like plan.md and spec.md.
Ingestion points: SKILL.md (Phase 1: Establish Scope Baseline), modules/pr-hygiene.md (Self-Review and Atomicity checks), and modules/version-validation.md.
Boundary markers: Absent. There are no specific delimiters or instructions used to separate the ingested untrusted text from the skill's operational instructions, which could allow a malicious PR author to influence the agent's logic.
Capability inventory: The skill has extensive shell command capabilities (gh, glab, find, grep, awk, git), Python execution (python3 -c), and the ability to call other internal tools (Skill() references).
Sanitization: Absent. PR data (such as descriptions and filenames) is interpolated into shell commands and agent prompts without explicit escaping or filtering.
[DYNAMIC_EXECUTION]: The skill dynamically generates and executes Python code and shell commands to perform tasks such as insight generation and suggestion posting.
Evidence: modules/insight-generation.md uses python3 -c to invoke internal project scripts. modules/github-comments.md and modules/suggestion-comments.md construct shell commands and API payloads using runtime variables.
[COMMAND_EXECUTION]: The skill makes heavy use of system utilities and platform-specific CLI tools to perform its primary functions, representing a large capability surface.
Evidence: Extensive shell script logic is present throughout SKILL.md and modules/pr-hygiene.md for operations such as searching for files, extracting commit history, and checking for architectural patterns in code diffs.

pr-review