The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from Pull Request and Issue bodies, creating a vulnerability surface for indirect prompt injection. Ingestion points: PR and Issue metadata and bodies are fetched in SKILL.md (Steps 1b, 3b) and references/tracker-state-poller-subagent.md. Boundary markers: The skill includes references/untrusted-content-rule.md which explicitly mandates treating external text as data, not instructions. Capability inventory: Includes network operations via curl and gh, and local file system writes in SKILL.md and references/defer-mutation.js. Sanitization: Employs references/github-body-text.js to escape control characters that could be misinterpreted by GitHub.
[CREDENTIALS_UNSAFE]: Accesses sensitive credentials (JIRA_API_TOKEN, BITBUCKET_ACCESS_TOKEN) from .env and .secrets/tooling.env for interacting with official Atlassian and Bitbucket APIs. These operations are conducted toward well-known services and include automated redaction in the references/defer-mutation.js logging logic.
[COMMAND_EXECUTION]: Executes several internal scripts and Node.js utilities (e.g., resolve-platform.sh, finding-anchors.js, pr-inline-comment.js) to automate platform resolution and finding verification. These commands are restricted to local files included within the skill package.

review-pr