The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes Pull Request comments from GitHub or Bitbucket, which are untrusted external inputs. These comments are passed to a sub-agent for evaluation, creating a surface where malicious instructions embedded in comments could influence the agent's reasoning.
Ingestion Point: Step 1 in SKILL.md fetches comment bodies using gh api or curl.
Capability Inventory: The sub-agent has read-only access to the project tree and git history to verify claims but is explicitly restricted from writing or posting updates.
Boundary Markers: The instructions do not apply specific wrapping or delimiters to the comment text before passing it to the sub-agent.
Sanitization: No formal sanitization is performed on the comment text, although the workflow incorporates a Human-in-the-Loop (HITL) step where a human decides the disposition of each thread.
[COMMAND_EXECUTION]: The skill makes extensive use of local shell commands to interact with version control systems and maintain local state in a sidecar directory.
Evidence: Numerous shell blocks in SKILL.md and the utility script references/sidecar.sh execute git, gh, jq, and curl.
Mitigation: Bitbucket API tokens are passed to curl using configuration files on stdin to avoid exposure in process lists, and URL inputs are validated for control characters to prevent header or command injection.

respond-to-review