The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze untrusted data from GitHub pull requests, creating an attack surface for indirect prompt injection.
Ingestion points: The skill reads PR titles, descriptions, and comments through gh pr view and custom GraphQL queries in scripts/state.sh. It also ingests the entire code diff and surrounding context via git diff and git worktree operations defined in SKILL.md.
Boundary markers: The skill employs HTML comment markers (e.g., ) to manage its own state within PR comments. However, the subagent prompts provided in references/prompts.md do not include explicit 'ignore' instructions or delimiting strategies to prevent the agent from obeying malicious instructions embedded within the PR code or comments.
Capability inventory: Across its scripts and instructions, the skill has the capability to perform repository operations (git), read environment data, and execute network-enabled commands via the GitHub CLI (gh api) to post or modify reviews and comments.
Sanitization: The scripts/state.sh utility demonstrates good practice by using jq to build JSON payloads for the GitHub API, which prevents structured data injection. However, it does not perform sanitization or filtering of the natural language content before passing it to the subagents for analysis.

pr-review