The Agent Skills Directory

[COMMAND_EXECUTION]: In manifest mode, the skill executes instructions defined in the PR manifest (specifically verify.instructions which include tests, builds, and greps) against the PR head SHA. This allows for the execution of arbitrary shell commands or scripts provided by the PR author.
[INDIRECT_PROMPT_INJECTION]: The skill ingests extensive untrusted data including PR descriptions, author comments, and conversation history. This data is fed into subagents (the 'reviewer fleet' and 'per-comment verifiers') to influence review findings and automated replies, creating a significant surface for indirect prompt injection.
Ingestion points: PR description, commit messages, PR conversation (replies/threads), linked-PR context (diffs/descriptions), and manifest content.
Boundary markers: No explicit boundary markers or sanitization logic is mentioned for the ingested PR data.
Capability inventory: Command execution (shell commands), file system access (checkout and grep), and network/API access (GitHub PR comments, resolutions, and approvals).
Sanitization: None mentioned for external content interpolation into prompts.
[REMOTE_CODE_EXECUTION]: The skill references and attempts to activate external agents (prompt-token-efficiency-verifier and prompt-compression-verifier) if they are available. These represent a dependency on external code logic not contained within the skill's own instructions.
[DATA_EXPOSURE]: The operational-readiness dimension of the reviewer fleet is specifically tasked with scanning for secrets in CI/infra, environment configurations, and migrations. While intended for PR safety, it demonstrates the skill's ability to access and potentially leak sensitive credentials if the subagent is compromised via indirect injection.

review-pr