The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses dynamic context injection in SKILL.md that interpolates the $ARGUMENTS variable directly into a shell command (gh pr view "$ARGUMENTS"). This presents a high risk of command injection if the user-supplied input contains shell metacharacters.
[DATA_EXFILTRATION]: The skill automatically executes gh auth status within its dynamic context in SKILL.md. This silently reveals authentication status and account information every time the skill is loaded, which could be exploited to harvest environment metadata.
[PROMPT_INJECTION]: The skill contains a significant indirect prompt injection attack surface as it processes untrusted data from external sources.
Ingestion points: The agent reads pull request diffs via gh pr diff, reviewer comments via gh api ... comments, and CI logs via gh run view --log-failed as specified in SKILL.md and references/review-loop.md.
Boundary markers: While prompt templates use structured headers like Context: and Comments to evaluate:, they lack explicit instructions or strict delimiters to prevent the agent from following malicious instructions embedded within the ingested data.
Capability inventory: The skill has extensive permissions, including the ability to write code (git commit), update repository state (git push), edit pull request details (gh pr edit), and perform final merges (gh pr merge).
Sanitization: No input sanitization or validation is performed on the PR diffs or comments before they are passed to the triage and review sub-agents.
[COMMAND_EXECUTION]: The skill is configured to perform autonomous repository actions, specifically the automatic merging of pull requests in Phase 5 of SKILL.md and references/closeout.md. The instructions explicitly command the agent to never ask for user confirmation, which removes human oversight from sensitive write operations.

review-pr