The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of shell commands via glab and git to manage merge requests and code analysis. These are core functionalities for the skill's purpose. The use of --detach and isolated /tmp directories for git worktrees follows security best practices to prevent unintended modifications to the user's primary repository checkout.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an automated reviewer for external code (GitLab MRs). This creates a surface for indirect prompt injection where a malicious MR could contain instructions designed to influence the agent's behavior.
Ingestion points: MR metadata, diffs, and file content are fetched from GitLab and processed in the worktree (SKILL.md step 2).
Boundary markers: The instructions include a specific signature block to identify AI-generated comments, which helps distinguish agent output, though it does not provide strict data/instruction isolation.
Capability inventory: The skill has capabilities to execute shell commands (glab, git), read/write files in the temporary worktree, and post comments to GitLab via the glab API.
Sanitization: The skill relies on the LLM's internal guardrails when processing MR content. It enforces structured signed comments to maintain accountability.

gitlab-mr-review