The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several shell commands via the GitHub CLI (gh) to perform its tasks, including gh pr diff, gh pr view, gh pr comment, and provides a command template for gh pr merge --admin. It also executes a local bash script templates/regression_guard.sh.
[DATA_EXFILTRATION]: The skill is designed to read local files such as memory feedback_*.md and CLAUDE.md, which contain naming and decision baselines. There is an inherent risk that sensitive information from these local files could be inadvertently included in public PR comments. The skill acknowledges this and mandates a sanitization step using a /public-surface-audit tool to redact leaked spans before posting.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, specifically pull request diffs and metadata via gh pr diff. This data is then processed to perform consistency checks and generate review comments.
Ingestion points: PR diff and metadata retrieved using gh pr diff and gh pr view as documented in SKILL_detail.md.
Boundary markers: The instructions do not specify explicit delimiters or "ignore embedded instructions" warnings to separate the untrusted PR content from the skill's instructions.
Capability inventory: The skill has the capability to write to the PR via gh pr comment and provides instructions for merging via gh pr merge. It also executes local scripts like regression_guard.sh via a subprocess.
Sanitization: A /public-surface-audit is mandated for the outgoing review comment text to prevent data leaks, but no explicit sanitization or filtering is mentioned for the ingested PR content against prompt injection.

harness-pr-reviewer