The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources (GitHub PRs and GitLab MRs).
Ingestion points: Untrusted data enters the agent's context through PR descriptions, commit messages, comments, and the code diff itself retrieved via gh pr view and gh pr diff.
Boundary markers: The instructions lack explicit boundary markers or system-level warnings to the agent to ignore instructions embedded within the PR content.
Capability inventory: The skill allows the agent to clone repositories, perform shell commands, and interact with the GitHub/GitLab API to post comments and update PR statuses.
Sanitization: No sanitization or escaping mechanisms are defined to handle malicious markdown or instructions within the PR data.
[COMMAND_EXECUTION]: The workflow explicitly suggests that the agent "consider running the test suite locally and checking for TypeScript errors."
Executing test suites involves running arbitrary code defined within the repository being reviewed. A malicious PR could include modified tests or build scripts (e.g., package.json, Makefile, or test files) designed to execute harmful commands on the agent's local environment during execution.
[EXTERNAL_DOWNLOADS]: The skill uses gh repo clone to download full codebases from external, user-specified URLs to the local /workspace/personal/ directory.
While the use of official GitHub/GitLab CLI tools is standard, the content being downloaded is untrusted and originates from third-party contributors.

review-pr