The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted content from external sources, which creates a surface for indirect prompt injection attacks.
Ingestion points: The agent reads content from git diff (local working tree and staged changes), GitHub Pull Request descriptions, and PR comments retrieved via gh pr checkout (as described in SKILL.md).
Boundary markers: The instructions lack explicit boundary markers or delimiters to differentiate between the agent's operational instructions and the potentially untrusted code content being reviewed.
Capability inventory: The skill utilizes npm run preflight (which can execute arbitrary shell scripts defined in the project's package.json), gh pr checkout, and general file system read/write access (SKILL.md).
Sanitization: There is no evidence of sanitization, filtering, or validation of the ingested code or PR metadata before it is processed by the agent's logic.
[COMMAND_EXECUTION]: The skill executes shell commands to perform its core functions, including interacting with the local repository and the project's build system.
Evidence: The workflow instructs the agent to run gh pr checkout, npm run preflight, git status, and git diff (SKILL.md). While these are standard development tasks, executing npm run preflight on a PR could trigger malicious scripts if the PR has modified the project's configuration files.

code-reviewer