The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and follow instructions embedded in external data (GitHub PR comments and review bodies), creating a vulnerability surface where a reviewer could potentially inject malicious instructions that the agent would execute.
Ingestion points: Data is fetched from GitHub via gh api calls to the pulls/$PR/comments and pulls/$PR/reviews endpoints, as described in SKILL.md and references/coderabbit_parsing.md.
Boundary markers: None. The skill lacks delimiters or instructions to ignore malicious directives within the fetched content. It explicitly encourages the agent to follow "Prompt for AI Agents" blocks found in the PR content.
Capability inventory: The skill allows the agent to modify the filesystem, commit code, and interact with the GitHub API, providing multiple vectors for an injected instruction to perform unauthorized actions.
Sanitization: There is no evidence of sanitization or verification of the instructions provided in the PR comments before the agent proceeds with code modifications.
[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes dynamic context injection to pre-fetch PR metadata when the skill is loaded.
Evidence: SKILL.md contains the command !`gh pr view --json number,title,state,milestone ...`.
This command is used to display status information and does not appear to involve unsafe interpolation of user-supplied arguments.
[COMMAND_EXECUTION]: The skill executes multiple shell commands using the GitHub CLI (gh) and Git to manage the PR review process.
Evidence: Extensive use of gh api, gh pr view, git log, and gh pr review throughout the SKILL.md and references/coderabbit_parsing.md files.
These commands are consistent with the skill's stated purpose of PR management and target a well-known service (GitHub).

github-pr-review