The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it ingests and processes untrusted data from external sources (pull requests and git diffs).
Ingestion points: The skill reads external content via gh pr diff, git diff, and by reading the full content of untracked files identified in git status.
Boundary markers: The instructions do not specify explicit delimiters or "ignore instructions" warnings to wrap the ingested code content, which could allow malicious instructions embedded in the code to influence the agent.
Capability inventory: The skill uses git and gh command-line tools and has the capability to write to the local file system when applying approved fixes.
Sanitization: No explicit sanitization or filtering of the ingested diff/file content is described.
Mitigation: The skill implements a robust defense-in-depth pattern by using a high-tier subagent specifically instructed to adversarially validate and refute findings, which helps mitigate risks associated with processing untrusted input.

lite-review