The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes pull request comments and review bodies which are externally controlled and potentially adversarial.
Ingestion points: Untrusted data enters via scripts/fetch-pr-info.js which queries GitHub GraphQL API for all PR comments and reviews.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore malicious directives embedded within PR comments.
Capability inventory: The skill environment has gh and git CLI tools available, allowing file reads and potential code modifications if an agent follows instructions embedded in a comment.
Sanitization: There is no sanitization or filtering of the comment content beyond a basic ignore-list for bot welcome messages.
[COMMAND_EXECUTION]: The script scripts/fetch-pr-info.js executes several shell commands (git branch, gh auth status, gh pr diff, git log, gh api graphql) to collect PR state.
The commands are used for their intended purpose within a developer workflow for a Google-owned project (google-gemini/gemini-cli).
The branch variable is retrieved directly from git branch --show-current and used in a GraphQL query argument, which is a safe interpolation of local repository state.

pr-address-comments