The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using subprocess.run in its internal scripts (fetch_pr_diff.py, review_operator.py, and post_review.py) to interact with git and the gh (GitHub CLI) tool. All executions use list-based arguments, avoiding shell interpolation and minimizing the risk of command injection.
[EXTERNAL_DOWNLOADS]: Pull Request diffs and file contents are downloaded from GitHub via the gh CLI. These operations target a well-known technology service and are necessary for the skill's primary function of code review.
[DATA_EXFILTRATION]: While the skill accesses file contents and handles a GitHub token (GH_TOKEN), no data is sent to external or untrusted domains. All network communication is restricted to the GitHub API via official tooling.
[CREDENTIALS_UNSAFE]: The skill correctly manages authentication by requiring the user to set the GH_TOKEN as an environment variable or authenticate via gh auth login. No sensitive keys are hardcoded in the skill's files.
[PROMPT_INJECTION]: The instructions in SKILL.md are descriptive and procedural, focusing on the environment validation and review workflow. There are no attempts to override system behavior or bypass safety guardrails.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code content from external contributors' PRs. However, the core analysis is performed using Python's ast module and regular expressions within localized scripts, rather than directly prompting the LLM with raw, untrusted code strings, which mitigates the risk of indirect injection.

flaggems-pr-review-flagos