The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a processing pipeline that ingests untrusted data from pull request diffs, branch names, and code symbols, which are subsequently interpolated into shell commands.
Ingestion points: Pull request URLs, branch names, diff content, and pasted code processed in SKILL.md (Step 1).
Boundary markers: The instructions do not define boundary markers to separate data from instructions within the diffs, nor do they instruct the agent to ignore embedded instructions in the reviewed code.
Capability inventory: The skill utilizes git (log, show, blame, diff), gh (pr list/view), and curl for historical forensics and behavior observation.
Sanitization: There are no instructions for sanitizing or escaping shell metacharacters in strings harvested from the PR before they are passed to shell commands.
[COMMAND_EXECUTION]: The skill instructs the agent to perform dynamic shell command execution based on untrusted external inputs.
Evidence: references/history-forensics.md suggests commands such as git log -S '<symbol_or_constant>' where the symbol is extracted from the PR content.
Evidence: SKILL.md (Step 3, Pass I) explicitly directs the agent to run curl commands against the environment to observe behavior changes described in the PR.

pr-review