The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The CI workflows and setup instructions retrieve additional agent skills from the author's repository to provide specialized Go engineering knowledge.
Evidence: The assets/claude-code-review.yml workflow and assets/copilot-review-instructions.md documentation use npx skills add to fetch resources from https://github.com/fabianoflorentino/golang-agent-skills. This is a standard mechanism for extending the agent's capabilities within this ecosystem.
[INDIRECT_PROMPT_INJECTION]: The AI review logic in assets/claude-code-review.yml ingests external data that could be controlled by an attacker, creating a surface for indirect prompt injection.
Ingestion points: The quality, correctness, security, and quality-depth jobs in assets/claude-code-review.yml ingest data via gh pr diff and gh pr view commands.
Boundary markers: The prompts use structured sections and headers to define the task, but they do not use specific delimiters or protective instructions (e.g., "ignore embedded instructions") around the external PR data.
Capability inventory: The workflow is granted pull-requests: write and actions: read permissions. It is explicitly authorized to use tools for creating inline comments and interacting with the GitHub CLI to post feedback.
Sanitization: No explicit sanitization, filtering, or validation of the pull request content is performed before it is processed by the AI agent.

golang-continuous-integration