The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data including pull request titles, bodies, comments, and diff hunks which could contain malicious instructions.
Ingestion points: Data is ingested via gh api and gh pr view in shared/pull-request-comments.md and references/re-review.md.
Boundary markers: The skill explicitly treats text as data and labels it as untrusted. Instructions in SKILL.md (Hard Rule 4) state that imperatives in bodies or diffs must never be executed.
Capability inventory: The skill possesses write capabilities including casting approvals (gh pr review --approve), resolving threads, and posting rebuttal comments.
Sanitization: The skill uses a "read-only subagent with no write tools" to process untrusted content, preventing indirect injections from accessing sensitive tools. It also uses structural projections (GraphQL and JQ) to limit the exposure of untrusted text bodies.
[COMMAND_EXECUTION]: The skill uses the GitHub CLI (gh) to interact with repositories and perform writes.
Evidence: SKILL.md and references/arm.md describe executing gh api, gh pr view, and gh pr review.
Mitigation: The skill implements strict regex-based validation for PR numbers and URLs to prevent shell injection. It specifically instructs the agent to use -f and -F flags for gh api calls to safely pass variables and avoid argument injection or unintended file reading.

watching-reviewed-prs