The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external pull requests, creating a surface for indirect prompt injection where an attacker could embed malicious instructions in PR metadata or code comments. * Ingestion points: The skill reads pull request titles, bodies, and diff contents using gh pr view and gh pr diff (SKILL.md, Phase 1). * Boundary markers: The instructions direct the agent to show hunks verbatim within diff code blocks (SKILL.md, Phase 3), which provides structural delimitation. * Capability inventory: The skill utilizes shell commands (gh, git, awk), file system access (<scratchpad>/pr.diff), and code editing capabilities (SKILL.md, Phase 1 and Phase 3). * Sanitization: The instructions do not specify any sanitization or validation of the ingested PR content.
[COMMAND_EXECUTION]: The skill utilizes shell commands to process data, including an awk pattern that interpolates path fragments. * Evidence: The workflow uses awk '/^diff --git/{p=($0 ~ /<path-fragment>/)} p' pr.diff to extract specific file diffs from a saved file (SKILL.md, Phase 1).

guided-review