The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code and metadata from GitHub pull requests and external tickets, creating a vulnerability surface.
Ingestion points: SKILL.md (Process step 1) loads the PR body, commits, diff, and all review threads. doctrine.md (Apply section) reads GitHub issues and Linear tickets.
Boundary markers: The skill notes that Linear tickets are "read-only context," but there are no explicit markers or instructions to delimit untrusted code from the agent's instructions.
Capability inventory: The agent uses the gh CLI to post comments, request changes, and submit reviews, which allows actions to be taken based on the processed untrusted data.
Sanitization: No explicit sanitization or escaping of the ingested diffs or PR descriptions is mentioned.
[COMMAND_EXECUTION]: The skill utilizes the gh CLI to perform its primary functions.
Evidence: SKILL.md (Process step 6) and doctrine.md (Apply section) specify using gh or gh api for all GitHub interactions. This is a legitimate and expected use of the platform's tools.

pr-review