The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/fetch_comments.py executes gh CLI commands using subprocess.run. While the implementation correctly uses list-based arguments to avoid shell injection, the skill relies on executing external binaries that interact with the host environment and network.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by ingesting and acting upon untrusted data from GitHub.
Ingestion points: The fetch_all function in scripts/fetch_comments.py retrieves the body text of pull request comments, reviews, and review threads via the GitHub GraphQL API.
Boundary markers: The skill instructions in SKILL.md lack explicit delimiters or instructions for the agent to ignore command-like text embedded within the PR comments.
Capability inventory: The agent is instructed to 'Apply fixes' for selected comments, giving it file-system write capabilities, while the skill itself utilizes gh for network-based API calls.
Sanitization: No sanitization, validation, or escaping is performed on the retrieved comment content before it is processed by the agent.
[CREDENTIALS_UNSAFE]: The instructions in SKILL.md explicitly prompt the user to run gh auth login and request sandbox_permissions=require_escalated to verify authentication status. This indicates a requirement for elevated environment privileges to manage GitHub credentials.

gh-address-comments