The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from external sources that can be controlled by third parties (e.g., PR descriptions, comments from reviewers, and code diffs) and possesses high-privilege capabilities such as file modification and command execution.
Ingestion points: The skill fetches PR metadata and comments in references/addressing-workflow.md (Step 2) and references/reviewing-workflow.md (Step 1). It also fetches the full PR diff in references/reviewing-workflow.md (Step 2).
Boundary markers: There are no explicit instructions or delimiters in the sub-agent reviewer prompts (e.g., in references/reviewing-workflow.md Step 4) to ignore potentially malicious instructions embedded in the diff or PR body.
Capability inventory: The skill is authorized to perform code modifications (references/addressing-workflow.md Step 4), run arbitrary repository-defined CI commands (references/merging-workflow.md Step 2), and push changes to the remote repository.
Sanitization: No sanitization or validation of the fetched PR content is performed before it is processed by the LLM sub-agents or used to influence command execution.
[COMMAND_EXECUTION]: The skill is designed to discover and execute CI/test commands found within the local repository (e.g., package.json, Makefile). While this is standard for developer tools, it allows for the execution of arbitrary scripts defined in the codebase, which could be exploited if a malicious pull request modifies these configuration files.
[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file uses the !command syntax to fetch the current git status and PR state when the skill is loaded. These commands (git status, git branch, gh pr view) are benign utility calls used to provide context and do not involve untrusted user input or sensitive file exfiltration.

pull-requests