The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the GitHub CLI (gh) and git to perform its tasks. It contains strong safeguards against command injection by explicitly stating in the 'Hard rules' that reviewer comments are treated as data and never interpolated into shell commands, scripts, or arguments.
[DATA_EXFILTRATION]: No exfiltration patterns detected. The skill writes artifacts only to a local /tmp scratch directory with restricted permissions (700) and communicates solely with the official GitHub API via the gh tool.
[PROMPT_INJECTION]: The skill uses a structured 'Evaluation Rubric' to guide the agent's decision-making process. It explicitly instructs the agent to ignore bot severity labels and evaluate each finding based on the actual code, reducing the risk of being misled by malicious or low-quality automated comments.
[PRIVILEGE_ESCALATION]: The skill explicitly forbids sudo, force-pushing, or modifying the system environment. It operates within the user's project context and uses a temporary directory for run artifacts.
[DYNAMIC_CONTEXT_INJECTION]: The skill uses shell blocks for initialization and GitHub API interactions, but these are statically defined and do not allow user-supplied arguments to influence the shell structure. The ! syntax is not used for untrusted data injection.

remedy