The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from pull request descriptions, commit messages, and source code contents which could contain malicious instructions designed to influence the agent's summary or tour generation.
Ingestion points: PR metadata and file contents are fetched in scripts/build.mjs and scripts/lib.mjs using gh and git commands.
Boundary markers: The instructions in SKILL.md advise the agent to never invent intent and to use verbatim quotes, providing behavioral constraints to mitigate obedience to embedded instructions.
Capability inventory: The skill utilizes execFileSync across its scripts to execute git and gh CLI tools.
Sanitization: The scripts/annotate.mjs script provides a robust validation layer, ensuring that model-generated quotes are verbatim and that line pointers are accurate. It also explicitly forbids phrases that provide a security or merge verdict (e.g., 'LGTM', 'is safe'). Additionally, scripts/render.mjs performs HTML escaping for the final viewer output.
[COMMAND_EXECUTION]: The skill scripts (scripts/lib.mjs, scripts/build.mjs, scripts/tour.mjs) use node:child_process.execFileSync to interact with system tools like git and gh and to trigger sub-processes like the report renderer. While standard for this use case, these operations represent a capability surface for executing CLI commands based on the environment and PR context.

pr-tour