The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection attacks. It ingests untrusted data from GitHub PR comments and reviews via scripts/fetch_comments.py and is instructed to autonomously interpret this content to "Apply fixes to all actionable issues." An attacker with comment access to the repository could potentially provide malicious instructions disguised as review feedback to manipulate the agent into performing unauthorized code changes.
Ingestion points: The script scripts/fetch_comments.py retrieves comments, reviews, and reviewThreads from the GitHub GraphQL API.
Boundary markers: The instructions do not define clear delimiters or provide instructions for the agent to distinguish between valid feedback and adversarial prompts within the fetched data.
Capability inventory: The agent has permissions to modify local files, execute tests, and perform git operations (commit/push) via the gh CLI.
Sanitization: No validation or sanitization of the comment body text is performed before it is processed by the agent.
[COMMAND_EXECUTION]: The script scripts/fetch_comments.py uses subprocess.run() to execute GitHub CLI (gh) commands. While the implementation uses list-based arguments which prevents traditional shell injection, these commands grant the agent the ability to interact with the remote repository and perform potentially destructive actions if the agent's logic is compromised via injection.

address-pr-comments