The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the gh (GitHub CLI) and pylot (vendor-specific CLI) to fetch PR details, diffs, comments, and team configurations. It also uses these tools to post comments, edit labels, and merge PRs.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from pull request bodies and comments.
Ingestion points: PR descriptions and comment threads are captured in the handoff.md file during Stage 01.
Boundary markers: Handoff files use markdown headers like ## PR Description and ## All PR Comments to delimit external data.
Capability inventory: The skill has merge authority and can post comments and modify labels on GitHub.
Sanitization: External content is not sanitized before being provided to the review subagent in Stage 02.
[EXTERNAL_DOWNLOADS]: The skill retrieves build records from an external staging server. The URL for this server is provided via the PYLOT_STAGING_URL environment variable, and the request includes an authentication token from the PYLOT_STAGING_DISPATCH_TOKEN environment variable.

cto-review