The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from task bodies and metadata which could contain malicious instructions or shell metacharacters. \n
Ingestion points: The skill reads task data via agkan task list as described in SKILL.md and implemented in review.sh (line 10). \n
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat task content as untrusted data or to ignore embedded commands. \n
Capability inventory: The skill has permissions to update task statuses (agkan task update), add comments (agkan task comment add), and query GitHub repositories (gh pr view). \n
Sanitization: While review.sh uses sed to extract URLs starting with https://, it does not sanitize for shell injection characters (e.g., semicolons, backticks, or subshell syntax) that might be processed if the agent executes the workflow manually without strict quoting.

agkan-review