The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses !"command" syntax in SKILL.md to execute shell commands at load time. This includes gh pr view, git remote -v, and gh auth status. These commands are used to populate the agent's context with repository and PR metadata.
[REMOTE_CODE_EXECUTION]: The skill launches a persistent background process using a local script: ${CLAUDE_PLUGIN_ROOT}/skills/review-pr/scripts/review-loop.sh. This script performs continuous polling of the GitHub API for CI status and PR comments. While the script is local to the skill, it represents a persistent background execution pattern.
[PROMPT_INJECTION]: In SKILL.md, the $ARGUMENTS variable is directly interpolated into a shell command within the dynamic context block: gh pr view "$ARGUMENTS". If a user provides a malicious PR argument (e.g., ; rm -rf /), this could lead to command injection, although the use of double quotes and 2>/dev/null provides some mitigation.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and act upon data from external sources (GitHub PR comments and CI logs).
Ingestion points: PR comments (issue-level, inline, and review summaries) and CI logs are fetched via gh CLI in scripts/review-loop.sh and Phase 3 of SKILL.md.
Boundary markers: The skill instructs the agent to use a 'skeptical code reviewer' persona and an 'independent review-triage agent' with a 'clean context' to evaluate comments, which acts as a logical boundary.
Capability inventory: The skill has significant capabilities, including Edit, Write, and Bash (via gh and git for committing and pushing code fixes), and PushNotification for escalating issues.
Sanitization: The skill uses jq to extract data from JSON responses and gsub to remove newlines from comment bodies before processing, but it does not perform deep sanitization of the natural language content within comments before feeding them to the triage agent.

review-pr