The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Pull Request comments and user-provided invocation arguments.
Ingestion points: PR comment bodies are fetched from GitHub, and PR URLs or numbers are provided as arguments during invocation.
Boundary markers: Explicit security sections in SKILL.md and references/agents/pr-comment-resolver.md warn the agent against executing instructions found in untrusted comment text.
Capability inventory: The skill uses gh, git, bash, and python3. It can modify files, commit changes, and interact with the GitHub API.
Sanitization: Instructions require the agent to independently judge feedback validity. However, some documentation (e.g., in references/full-mode.md) provides bash templates that interpolate untrusted input, such as <pr-url-if-one-was-passed>, into shell commands. This could lead to command injection if the agent does not properly sanitize or parse the URL before insertion.
[COMMAND_EXECUTION]: The skill heavily utilizes shell commands for automation.
The Python helper: scripts/pending-feedback.py invokes the GitHub CLI via subprocess.run. It uses the safe list-based execution method and applies strict regular expression validation to all dynamic arguments (e.g., hosts, repository names, and commit SHAs) to prevent injection.
Bundled bash scripts: These scripts use the gh tool's -f flag to safely pass data as fields in API requests, avoiding shell interpretation of the content.

ce-resolve-pr-feedback