The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection because it fetches and processes untrusted external data from GitHub Pull Requests, including PR titles, bodies, review comments, and code diffs. This data is then interpolated into prompts for detect and validate subagents.
Ingestion points: External data is ingested in prepare-review.py (fetching diffs and comments) and extract-pr-images.py (fetching images).
Boundary markers: While the data is wrapped in markdown code blocks within the subagent prompts, there are no explicit 'ignore instructions' delimiters or strong structural boundaries to prevent a subagent from obeying instructions hidden in a code comment or PR description.
Capability inventory: The skill possesses the capability to post comments, resolve threads, and approve PRs on GitHub through the gh CLI, which could be abused if a subagent is compromised.
Sanitization: The skill lacks robust sanitization for the PR content, performing only minimal @mention filtering in post-review.py.
[COMMAND_EXECUTION]: The skill frequently executes shell commands using subprocess.run to interact with git and the gh CLI, as well as to run its own modular Python scripts. Although it uses list-based arguments to avoid shell injection vulnerabilities, it creates an execution environment where locally stored configuration (like manifest.json) influences command arguments.
Evidence: Subprocess calls are present in prepare-review.py, collect-results.py, post-review.py, and scripts/resolve-bot-threads.py.

review-prs