The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from pull request diffs and project files, interpolating them into subagent instructions which can lead to adversarial influence over agent actions.
Ingestion points: The diff_content (from git diff) and project_context (from CLAUDE.md) are read in SKILL.md (Step 7) and passed to subagents.
Boundary markers: The skill uses <agent-instructions>, <diff>, and <project-context> XML-style delimiters to separate instructions from untrusted data.
Capability inventory: The skill possesses significant capabilities including merging pull requests (gh pr merge), committing code to the repository (git commit), and creating new GitHub issues (gh issue create) based on review findings (Steps 10-11 in SKILL.md).
Sanitization: No explicit sanitization or escaping of the diff content is performed before it is placed within the boundary tags.
[COMMAND_EXECUTION]: The skill executes multiple local shell commands and GitHub CLI tools as part of its normal workflow.
Evidence: The skill calls git diff, gh pr view, gh pr merge, and gh issue create. It also executes internal logic via Node.js (scripts/kata-lib.cjs) and Bash (scripts/manage-worktree.sh). While these are intended functions, they represent a powerful execution environment that could be targeted via injection.

kata-review-pull-requests