The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes the GitHub CLI (gh) and the Python runner uv to manage pull request metadata.
Subprocess calls in scripts/classify_pr_files.py use argument lists rather than shell strings, which is a standard security practice to prevent shell injection.
The mark_files_viewed function utilizes the gh api graphql -f flag to pass path variables, protecting against injection in the GraphQL query structure.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of pull request paths and diff patches from the getsentry/sentry repository.
The classification logic is handled entirely by a Python script using regular expressions, bypassing LLM-based decision making for the core classification task.
A mandatory human-in-the-loop confirmation is required before any state-changing action (marking files as viewed) is performed.
An 'approval token' mechanism (SHA-256 hash of the PR state and proposed noise set) ensures that the mutation only acts on the exact file set reviewed and approved by the user.
[DATA_EXFILTRATION]: The skill interacts with the GitHub API to read and write pull request status.
Execution is restricted to the getsentry/sentry repository via URL and PR number validation in the resolve_pr function.
The skill does not access sensitive local credentials (other than utilizing the existing gh authentication) or communicate with unauthorized external domains.

scraps-review