The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from GitHub PR comments, review bodies, and conversation threads to determine code changes and draft replies. This creates a surface for indirect prompt injection where a reviewer could potentially influence the agent's behavior via their feedback.
Ingestion points: The skill fetches external content via GitHub API calls in Step 1, including GraphQL reviewThreads, REST /pulls/<n>/reviews, and REST /issues/<n>/comments (SKILL.md).
Boundary markers: A mandatory confirmation gate is implemented in Step 5, requiring explicit user approval for all diffs, commit messages, and replies before any remote actions occur.
Capability inventory: The skill possesses the capability to edit local files, execute project scripts, commit changes, push to remote branches, and post PR comments/resolutions via the GitHub CLI.
Sanitization: While no specific input sanitization for LLM context is described, the skill uses a scratchpad file for drafting replies (Step 4) to prevent shell escaping issues during API calls (Step 6).
[COMMAND_EXECUTION]: In Step 3, the skill executes project-defined scripts such as build scripts, test suites (e.g., Pest), and linters. While these are expected for development workflows, they involve executing arbitrary commands defined within the local repository environment.

review-threads