The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and acts upon untrusted data from external GitHub resources.
Ingestion points: The agent retrieves data from GitHub Issue descriptions (gh issue view) and Pull Request diffs and descriptions (gh pr list, gh pr diff) as described in the workflow in SKILL.md.
Boundary markers: There are no boundary markers or explicit instructions provided to the agent to treat embedded instructions in the PR/Issue content as data rather than instructions.
Capability inventory: The agent has permissions to modify the repository (git commit, git push), merge pull requests (gh pr merge), and execute local scripts or tests ("Run the tests locally" in SKILL.md).
Sanitization: The skill does not perform any sanitization or validation of the retrieved text from GitHub before the agent processes it.
[COMMAND_EXECUTION]: The skill instructs the agent to "Run the tests locally" after checking out code from a Pull Request. This involves executing arbitrary code provided by potentially untrusted contributors, which could lead to code execution in the agent's environment.
[COMMAND_EXECUTION]: The bundled script scripts/approve_or_merge_pr.sh uses the $PR_NUMBER variable directly in shell commands without sanitization. While the agent is the intended caller, this represents a potential command injection surface if the PR number were sourced from an untrusted or manipulated string.

user-story-reviewer