The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from the repository being reviewed and explicitly instructs the agent to follow instructions contained within that data.\n
Ingestion points: The agent reads AGENTS.md and CLAUDE.md from the consumer repository (as described in references/repository-policy.md) and pulls PR descriptions, commits, and file contents (as described in references/review-pr.md).\n
Boundary markers: Absent. The skill does not define specific delimiters or instructions to ignore embedded commands.\n
Capability inventory: The skill uses spawnSync for the issue-flow CLI in scripts/optional-cli.mjs and executes repository-defined test/build commands in references/evidence.md.\n
Sanitization: Absent. External content is used to guide agent actions without filtering.\n- [COMMAND_EXECUTION]: The skill directs the agent to execute build and test checks discovered in the target repository. This allows a malicious pull request to trigger the execution of arbitrary code during the review process.\n
Evidence: references/evidence.md states the agent should "Read the repository's test/build instructions and execute the relevant checks after the final meaningful change."\n- [EXTERNAL_DOWNLOADS]: The skill depends on the external issue-flow CLI tool and references a bundled helper scripts/artifacts.mjs which is missing from the provided skill files.\n
Evidence: References to scripts/artifacts.mjs are found in SKILL.md, references/review-pr.md, and references/issue-input.md. The dependency on issue-flow is documented in references/cli-integration.md and utilized in scripts/optional-cli.mjs.

review-pr