The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of PR comments from AI bots (CodeRabbit, Sourcery, Gemini). This creates a surface for indirect prompt injection where a malicious or compromised bot output could attempt to influence the agent's behavior.
Ingestion points: Comments are fetched from the GitHub API or the review-bots tool as specified in SKILL.md.
Boundary markers: The skill provides logic-based boundaries by instructing the agent to 'Verify each comment against the code' and explicitly forbidding modifications to sensitive files.
Capability inventory: The agent has the ability to modify files, execute local project commands (lint/test), commit and push changes to Git, and merge pull requests.
Sanitization: There is no structural sanitization (like JSON schema validation) for the natural language comments, though there is a file-path blacklist for auth, secrets, .env, and Dockerfiles.
[COMMAND_EXECUTION]: The skill is instructed to 'Run the project's own lint, typecheck, and nearby tests'. This involves executing arbitrary code or scripts defined within the repository being reviewed. If the repository or the proposed fix is malicious, this could lead to local code execution on the runner.

agent-loop-autoreview