The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources which could contain malicious instructions designed to influence the agent's review logic or behavior.
Ingestion points: The skill reads pull request/merge request descriptions, commit messages (git log), issue/ticket content, and various project documentation files (CLAUDE.md, STYLE.md, specs/, etc.) as documented in SKILL.md and pull-requests.md.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are mandated for the processing of external content.
Capability inventory: The agent has access to shell commands (git, gh, glab, jq), file system write access for review payloads, and network access via the host CLIs (github.md, gitlab.md).
Sanitization: The instructions do not specify sanitization or escaping of the ingested data before processing.
[COMMAND_EXECUTION]: The skill relies on executing shell commands with interpolated variables such as pull request numbers, repository owners, and project IDs.
Evidence: Templates in github.md and gitlab.md (e.g., gh pr view <n>, export GH_REPO=<owner>/<repo>, glab api "projects/<project>/...") use placeholders for user-supplied input. If the agent implementation fails to properly escape these values, it could lead to command injection if a malicious user provides a crafted branch name, repository name, or URL.

review