The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the GitHub CLI (gh) via Python's subprocess.run to fetch PR data, diffs, and post comments.
Evidence: Found in prepare-review.py, post-review.py, fetch-prs.py, and several scripts in the scripts/ directory.
Mitigation: Inputs such as repository names and usernames are validated using regular expressions in collect-results.py before being passed to subprocesses. Most operations use hardcoded or API-derived values rather than direct user input.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (PR diffs and comments) which are interpolated into subagent prompts. An attacker could potentially embed malicious instructions within a PR.
Mitigation: The skill implements a strong security boundary by default-filtering PRs to only those authored by organization members or trusted reviewers (managed via .ignore/org-members.txt). Additionally, subagents are forced through a 'Systematic Audit Requirement' that requires them to explicitly pass or fail specific rules, reducing the likelihood of a successful injection overriding the entire review process.
[EXTERNAL_DOWNLOADS]: The extract-pr-images.py script downloads images from external sources to provide visual context to the review process.
Mitigation: This script is highly hardened. It employs a strict host whitelist (GitHub-hosted domains only), caps the number of downloads per PR, enforces a 5MB file size limit, and verifies the final URL after redirects to prevent SSRF. Crucially, it only downloads images if the source author is a trusted organization member.

review-prs