The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from Pull Request comments and incorporates it into instructions for automated agents.\n
Ingestion points: templates/lead-monitoring-loop.md reads review comments from GitHub using the gh api.\n
Boundary markers: Comments are interpolated into templates/pr-agent-prompt.md using the {{COMMENT_LIST}} placeholder without sufficient isolation or instructions to ignore instructions embedded in the comments.\n
Capability inventory: The agents receiving these prompts have the authority to modify source code, commit changes, push to remote repositories, and interact with the GitHub API via the CLI.\n
Sanitization: There is no evidence of sanitization or schema validation for the ingested comment text before it is used in prompt construction.\n- [COMMAND_EXECUTION]: The skill relies on local shell command execution for its core functionality.\n
Utilizes git worktree for environment management and standard git commands for branch management and commits.\n
Uses the gh CLI for extensive interaction with the GitHub API to poll PR status and post replies.\n- [DATA_EXFILTRATION]: The skill facilitates the flow of repository data and review metadata between the local environment and GitHub.\n
Reads code and private PR discussion metadata.\n
Transmits modified code and automated responses to the origin GitHub repository.

cycle