The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a variety of shell commands using git and gh (GitHub CLI) to manage pull request checkouts, fetch diffs, and interact with the GitHub API. It also invokes external review tools such as codex and gemini.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (pull request code, descriptions, and comments) and passes this data to specialized subagents for analysis. This creates a surface for indirect prompt injection where malicious instructions embedded in a PR could attempt to influence the reviewer's behavior.
Ingestion points: Untrusted PR content is ingested via gh pr view, gh pr diff, and gh api calls in SKILL.md.
Boundary markers: The instructions do not specify the use of strict delimiters or explicit 'ignore embedded instructions' warnings when passing retrieved content to subagents.
Capability inventory: The skill possesses significant capabilities, including shell command execution, file system access (within the worktree), subagent spawning via the Agent tool, and the ability to post comments back to GitHub.
Sanitization: No explicit sanitization or validation of the retrieved PR content is mentioned before it is interpolated into subagent prompts.
[EXTERNAL_DOWNLOADS]: The skill references and invokes external review models/tools like codex review and gemini-cli-review. These tools interact with well-known external AI services to provide additional review perspectives.
[DYNAMIC_EXECUTION]: The skill dynamically spawns specialized subagents (e.g., freenet:skeptical-reviewer, freenet:big-picture-reviewer) based on a risk-tier assessment of the PR. This is a form of dynamic orchestration where the execution path depends on the data being processed.

pr-review