The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources and possesses write capabilities, creating a potential injection surface.
Ingestion points: The agent reads Pull Request content and diffs using gh pr view and git diff (SKILL.md).
Boundary markers: There are no explicit instructions for the agent to ignore or delimit instructions found within the PR code, although subagents are given specific role-based prompts.
Capability inventory: The skill is capable of pushing changes to repository branches and creating GitHub issues (SKILL.md).
Sanitization: No explicit sanitization or escaping of the code content is performed before interpolation into subagent prompts.
Mitigation: The risk is significantly reduced by the built-in policy that all state-changing actions (pushes and issue creation) are confirmation-gated by the user.
[COMMAND_EXECUTION]: The skill uses local shell commands (gh and git) to interact with the repository. These are standard developer tools and are used here for their intended purpose of PR management and diff analysis.

code-review