The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from GitHub Pull Requests, which creates an attack surface for indirect prompt injection.
Ingestion points: The skill fetches Pull Request metadata, descriptions, commit messages, and review comments using tools like mcp_github_github_pull_request_read and mcp_github_github_list_commits (identified in SKILL.md Step 4).
Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat external PR content as untrusted or to ignore embedded instructions within that content.
Capability inventory: The agent possesses significant capabilities, including writing HTML and Markdown files to the local workspace, merging pull requests, and posting comments to GitHub (identified in SKILL.md Steps 7, 8, and 11).
Sanitization: While the skill references accessibility standards for HTML generation, it lacks specific instructions for sanitizing Pull Request body text or comments before incorporating them into generated .html review documents, which could lead to XSS or downstream injection issues.

pr-review