The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of shell commands via gh (GitHub CLI) and git to view PR details, fetch diffs, manage worktrees, and post reviews. The construction of these commands (e.g., gh pr view <PR>) involves direct interpolation of user-provided arguments, which could lead to command injection if the agent does not properly sanitize the input.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (GitHub PR bodies, comments, and code) to perform automated audits and post reviews. A malicious PR author could embed instructions in the PR description or code comments designed to trick the audit lenses.
Ingestion points: The skill fetches PR metadata, descriptions, and comments using gh pr view in SKILL.md, and reads the entire changed codebase within a worktree for analysis.
Boundary markers: There are no explicit instructions or delimiters defined to separate the untrusted PR content from the agent's audit instructions when delegating tasks to subagents.
Capability inventory: The agent has the capability to post automated reviews, request changes, and execute a local monitoring script (watch-response.py).
Sanitization: The instructions do not specify any sanitization, filtering, or escaping of the PR content before it is processed by the analysis lenses.
[DYNAMIC_EXECUTION]: The skill executes a bundled Python script (watch-response.py) using python3 to monitor PR activity. This script interacts with the local filesystem (storing state in ~/.local/state/pr-brief-watch/) and the GitHub CLI. While the script itself appears functional and benign, it represents a dynamic execution surface within the skill's directory.

pr-brief