The Agent Skills Directory

[PROMPT_INJECTION]: The skill manages a significant indirect prompt injection surface by processing external PR comments. It implements comprehensive mitigations:
Ingestion points: Untrusted data enters the agent context via PR comments fetched in standards/automated-review-lifecycle.md (Step 2).
Boundary markers: The skill uses a quarantine mechanism, storing untrusted bodies in a raw_input field separate from trusted metadata.
Capability inventory: The skill can perform file writes (fix tasks), trigger CI checks, and post PR responses.
Sanitization: A dedicated ingest pass (Step 2.5) performs schema validation and length capping. Most notably, Step 4 includes an intent-based 'Security-claim classification gate' that routes any edit affecting trust, access, or scope assertions to a specialized security persona for verification before acceptance.
[COMMAND_EXECUTION]: The scripts/pr_doctor.py script utilizes subprocess.run to orchestrate internal automation tasks. The implementation follows best practices by passing arguments as lists and using a forwarding helper to maintain environment consistency, with no evidence of shell injection or unsafe user input interpolation.

workflow-pr-doctor