The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill executes the project's validation suite (tests, type-checks, builds) directly from the checked-out PR branch. This behavior executes code provided by the PR author; if a PR contains malicious logic within its tests or build configuration, it will be executed within the agent's environment.
Evidence: Phase 3 instructions to "Run the project's real suite (the piv-validate skill, or the plan's validation commands)" after performing a gh pr checkout.
[COMMAND_EXECUTION]: The skill uses the GitHub CLI (gh) to perform actions based on user-supplied $ARGUMENTS. While standard for PR management, it involves passing resolved PR identifiers into shell commands.
Evidence: Shell commands in Phase 1 (gh pr view {N}, gh pr diff {N}) and Phase 6 (gh pr review {N}) utilize variables derived from input arguments.
[PROMPT_INJECTION]: The skill processes untrusted data from external PRs, creating an indirect prompt injection surface that could influence the agent's review or behavior.
Ingestion points: PR metadata (title, body) and source code retrieved via gh pr view and gh pr checkout in SKILL.md.
Boundary markers: Absent. There are no explicit instructions or delimiters used to separate untrusted PR data from the agent's analysis instructions.
Capability inventory: Access to the file system, execution of the GitHub CLI, and the ability to run arbitrary project validation scripts.
Sanitization: Absent. The skill reads the PR content and passes it directly to the analysis agent and validation tools without filtering.

piv-review-pr