The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the gh CLI via the Bash tool to interact with GitHub repositories. This includes potentially sensitive operations such as approving PRs, commenting, and dismissing reviews. These actions are governed by instructions requiring explicit user confirmation before execution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, including pull request descriptions, commit messages, and comments via gh pr view and the GitHub API. This data is used to summarize changes and verify if earlier review points were addressed.
Ingestion points: SKILL.md (Steps 5 and 7) reads PR body, comments, reviews, and files using gh pr view and the GitHub API.
Boundary markers: The instructions include multiple warnings that the agent must treat output as a draft, show exact text to the user, and never perform write operations without explicit user approval.
Capability inventory: The skill uses the Bash tool for read and write operations on GitHub (e.g., gh pr review, gh pr comment).
Sanitization: While explicit string sanitization is not detailed, the skill relies on the user to verify all drafted content before it is submitted to the remote platform.
[DYNAMIC_EXECUTION]: In the 'Verify before commenting' section of SKILL.md, the agent is instructed to generate and execute small scripts or tests to verify claims made in a PR.
Evidence: Instructions state: 'Offer to run these (AskUserQuestion...) and run them before drafting. Use a scratch directory outside the repository, and delete the scripts afterwards.'
Context: This is a functional feature designed to improve the accuracy of the agent's review findings, with a requirement for user permission and the use of an isolated directory.

pr-triage